1756 ControlLogix Digital Safety I/O Modules User Manual, 1756 … · 2019. 11. 1. · ControlNet®, and DeviceNet® communication networks. CIP Safety™ Common Industrial Protocol

1756 ControlLogix Digital Safety I/O ModulesCatalog Numbers 1756-IB16S, 1756-OBV8S

User ManualOriginal Instructions

Important User Information

Read this document and the documents listed in the additional resources section about installation, configuration, and operation of this equipment before you install, configure, operate, or maintain this product. Users are required to familiarize themselves with installation and wiring instructions in addition to requirements of all applicable codes, laws, and standards.

Activities including installation, adjustments, putting into service, use, assembly, disassembly, and maintenance are required to be carried out by suitably trained personnel in accordance with applicable code of practice.

If this equipment is used in a manner not specified by the manufacturer, the protection provided by the equipment may be impaired.

In no event will Rockwell Automation, Inc. be responsible or liable for indirect or consequential damages resulting from the use or application of this equipment.

The examples and diagrams in this manual are included solely for illustrative purposes. Because of the many variables and requirements associated with any particular installation, Rockwell Automation, Inc. cannot assume responsibility or liability for actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, Inc. with respect to use of information, circuits, equipment, or software described in this manual.

Reproduction of the contents of this manual, in whole or in part, without written permission of Rockwell Automation, Inc., is prohibited.

Throughout this manual, when necessary, we use notes to make you aware of safety considerations.

Labels may also be on or inside the equipment to provide specific precautions.

WARNING: Identifies information about practices or circumstances that can cause an explosion in a hazardous environment, which may lead to personal injury or death, property damage, or economic loss.

ATTENTION: Identifies information about practices or circumstances that can lead to personal injury or death, property damage, or economic loss. Attentions help you identify a hazard, avoid a hazard, and recognize the consequence.

IMPORTANT Identifies information that is critical for successful application and understanding of the product.

SHOCK HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that dangerous voltage may be present.

BURN HAZARD: Labels may be on or inside the equipment, for example, a drive or motor, to alert people that surfaces may reach dangerous temperatures.

ARC FLASH HAZARD: Labels may be on or inside the equipment, for example, a motor control center, to alert people to potential Arc Flash. Arc Flash will cause severe injury or death. Wear proper Personal Protective Equipment (PPE). Follow ALL Regulatory requirements for safe work practices and for Personal Protective Equipment (PPE).

Table of Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Summary of Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Terminology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Additional Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Chapter 1Digital Safety I/O Module Operation in a Control System

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Controller and Software Compatibility. . . . . . . . . . . . . . . . . . . . . . 11

Overall System Safety Function. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Determine Conformity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121756-IB16S Single-channel Point Operation Type . . . . . . . . . . . 141756-OBV8S Single-channel or Dual-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Obtain Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15Safety Precautions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Safety Application Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Safe State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Configuration Signature and Ownership . . . . . . . . . . . . . . . . . . . . 19Reset 1756 ControlLogix Digital Safety I/O Modules to Out-of-Box State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

About the Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Local I/O Modules or Remote I/O Modules . . . . . . . . . . . . . . . . . . . . 23

Local I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Remote I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Ownership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Construct a System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Local I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Remote I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Configure the Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Connections with 1756 ControlLogix Digital Safety I/O Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Requested Packet Interval . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Connection Over an EtherNet/IP Network . . . . . . . . . . . . . . . . . 31

Input Module Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Local 1756 ControlLogix Digital Safety Input Modules. . . . . . . 31Remote 1756 ControlLogix Digital Safety Input Modules . . . . 32

Output Module Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Local Safety Output Modules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Remote Safety Output Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

External Means . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Protected Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Rockwell Automation Publication 1756-UM013B-EN-P - October 2019 3

Table of Contents

Chapter 2Features Common to 1756 ControlLogix Digital Safety I/O Modules

Input Module Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Output Module Compatibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Software Configurable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Module Data Quality Reporting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Module Inhibiting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Electronic Keying . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Module Firmware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Producer/Consumer Communication . . . . . . . . . . . . . . . . . . . . . . . . . . 44

Chapter 31756-IB16S Input Module Features

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Safety Application Suitability Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Use Test Output with a Safety Input. . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Single-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Safety Input Fault Reset . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

'Latch Fault until reset via output tag' mode is Enabled . . . . . . . 50'Latch Fault until reset via output tag' mode is Disabled . . . . . . . 50

Safety Input Delay Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50Off to On Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51On to Off Delay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Data Transfer at RPI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Module Health Diagnostic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Point Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Field Power Loss Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55Short Circuit Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Test Output Recovery After Overload or Short Circuit to Ground Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

Chapter 41756-OBV8S Output Module Features

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58Safety Application Suitability Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Safety Output with Test Pulse. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60Single-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Dual-channel Point Operation Type . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Safety Output Fault Reset. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

‘Latch Fault until reset via output tag’ mode is Enabled . . . . . . . 63‘Latch Fault until reset via output tag’ mode is Disabled. . . . . . . 63

Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64Module Health Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64Point Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Field Power Loss Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66No Load Detection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

4 Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

Table of Contents

Short Circuit Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Other Conditions That Can Trigger the Short Circuit Diagnostic on the 1756-OBV8S Module . . . . . . . . . . . . . . . . . . . . 69Output Recovery After Overload or Short Circuit to Ground Condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

Thermal Shutoff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Fault and Status Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71Configurable Channel-level Output State in Program Mode or Fault Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71Connection Fault Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Output Behavior Immediately After a Connection Fault. . . . . . 72Output State Once Connection is Re-established . . . . . . . . . . . . 72

Forcing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73Enable Forces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73Disable or Remove a Force . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74Check Force Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74GSV Instruction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Chapter 5Configure and Replace Safety Modules

Create a New Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78New Local Safety Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78New Remote I/O Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

Edit the Module Configuration Common Categories . . . . . . . . . . . . 82General Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83Connection Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85Safety Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86Module Info Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

Edit the 1756-IB16S Module Configuration Categories . . . . . . . . . . 88Input Points Category . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88Test Output Points Category. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

Edit the 1756-OBV8S Module Points Category . . . . . . . . . . . . . . . . . 90Point Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91Output State During Program Mode and Communications Fault Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

View the Module Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Replace a Safety Module . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Reset to Out-of-Box Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 93Replace a Module in a Logix 5000 System . . . . . . . . . . . . . . . . . . . 95


Table of Contents

Appendix ATroubleshoot Your Module Module Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

OK Status Indicators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104Use the Logix Designer Application for Troubleshooting . . . . . . . . 105

Warning Signal in the I/O Configuration Tree . . . . . . . . . . . . . 105Status and Fault Information in Module Properties Categories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106Module and Point Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108Logix Designer Application Tag Editor. . . . . . . . . . . . . . . . . . . . . 110

InternalFault Triggered on the Safety Output Module . . . . . . . . . . 111

Appendix BModule Tag Definitions Access the Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

Name Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1141756-IB16S Module Tags. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Input Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115Output Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

1756-OBV8S Module Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117Input Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117Output Tags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Appendix CApplication and Wiring Examples for Safety Modules

Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1191756-IB16S Module Wiring Diagrams . . . . . . . . . . . . . . . . . . . . . . . . . 1201756-OBV8S Module Wiring Diagrams . . . . . . . . . . . . . . . . . . . . . . . 123

Bipolar Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123Sourcing Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126

Appendix DSafety Data for Safety Modules 1756-IB16S Safety Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130

1756-OBV8S Safety Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .133


Preface

This manual describes how to use 1756 ControlLogix® Digital Safety I/O modules in Logix 5000™ control systems.

Make sure that you are familiar with the following:• Use of a safety controller in a Logix 5000 control system.• Use of safety systems.• Use Studio 5000 Logix Designer® application environment.

Summary of Changes This publication contains new and updated information.

Terminology The following table defines terms that are used in this manual.

Topic Page

The 1756-IB16S and 1756-OBV8S modules are only compatible with a 1756 ControlLogix Chassis, Series C. 10

Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module. 10, 25

Abbreviation Full Term Definition

1oo2 One out of Two Identifies the programmable electronic controller architecture.

CIP™ Common Industrial Protocol An industrial communication protocol that is used by Logix 5000-based automation systems on EtherNet/IP™, ControlNet®, and DeviceNet® communication networks.

CIP Safety™ Common Industrial Protocol – Safety Certified

SIL-rated version of CIP.

— Connection Logical communication channel for communication between nodes. Connections are maintained and controlled between masters and slaves.

CL Claim Limit The maximum safety integrity level (SIL) that can be achieved.

DC Diagnostic Coverage The ratio of the detected failure rate to the total failure rate.

EDS Electronic Data Sheet, A template that is used in RSNetWorx™ software to display the configuration parameters, I/O data profile, and connection-type support for a given I/O module. RSNetWorx software uses these simple text files to identify products and commission them on a network.

EN European Norm. The official European Standard.

GSV Get System Value A ladder logic instruction that retrieves specified controller status information and places it in a destination tag.

— Multicast The transmission of information from one sender to multiple receivers.

NAT Network Address Translation The translation of an Internet Protocol (IP) address to another IP address on another network.

ODVA Open DeviceNet Vendor Association A nonprofit association of vendors that are established for the promotion of CIP networks.

PC Personal computer Computer that is used to interface with and control a Logix-based system via the Studio 5000® environment.

PFD Probability of a dangerous failure on demand

The average probability of a system to fail to perform its design function on demand.

PFH Average frequency of a dangerous failure per hour

The probability of a system to have a dangerous failure occur per hour.

PL Performance Level ISO 13849-1 safety rating.

— Process safety time Period of time between a failure, that has the potential to give rise to a hazardous event, occurring in the Equipment Under Control (EUC) or EUC control system and the time by which action has to be completed in the EUC to help prevent the hazardous event occurring.


Preface

Additional Resources These resources contain information about related products from Rockwell Automation.

— Proof test Periodic test that detects failures in a safety-related system so that, if necessary, the system can be restored to an as-new condition or as close as practical to this condition.

SIL Safety Integrity Level A relative level of risk-reduction that is provided by a safety function, or to specify a target level of risk reduction.

SNN Safety Network Number Safety network number, which uniquely identifies a network across all networks in the safety system. You are responsible for assigning a unique number for each safety network or safety subnet within a system.

SSV Set System Value A ladder logic instruction that sets controller system data.

— Standard Devices or portions of devices that do not participate in the safety function.

— Unicast The transmission of information from one sender to one receiver.

Abbreviation Full Term Definition

Resource Description

1756 ControlLogix 16-point Sinking Safety Input Module Installation Instructions, publication 1756-IN079A-EN-P Provides installation information for the 1756-IB16S safety input module.

1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module Installation Instructions, publication 1756-IN081A-EN-P Provides installation information for the 1756-OBV8S safety output module.

ControlLogix Chassis Installation Instructions, publication 1756-IN621 Provides installation information for ControlLogix chassis.

ControlLogix Power Supply Installation Instructions, publication 1756-IN619 Provides installation information for ControlLogix power supplies.

ControlLogix I/O Modules Specifications Technical Data, publication 1756-TD002 Provides specifications, wiring diagrams, and schematics for ControlLogix I/O modules.

GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012

Provides information on how to achieve and maintain Safety Integrity Level (SIL) and Performance Level (PL) safety application requirements for GuardLogix® 5580 and Compact GuardLogix 5380 controllers.

ControlLogix 5580 and GuardLogix 5580 Controllers User Manual, publication 1756-UM543

Provides information on how to install, configure, program, and use ControlLogix 5580 controllers and GuardLogix 5580 controllers in Studio 5000 Logix Designer application projects.

Safety Automation Builder and SISTEMA Library

Download Safety Automation Builder® software to help simplify machine safety design and validation, and reduce time and costs. Integration with our risk assessment software provides you with consistent, reliable, and documented management of the Functional Safety Lifecycle.

The SISTEMA tool, also available for download from the Safety Automation Builder page, automates calculation of the attained Performance Level from the safety-related parts of a machine’s control system to (EN) ISO 13849-1.

Industrial Automation Wiring and Grounding Guidelines, publication 1770-4.1 Provides general guidelines for installing a Rockwell Automation industrial system.

Product Certifications website, rok.auto/certifications Provides declarations of conformity, certificates, and other certification details.


http://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm012_-en-p.pdf

http://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-e.pdf

https://literature.rockwellautomation.com/idc/groups/literature/documents/in/1756-in079_-en-p.pdf


https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um543_-en-p.pdf



https://www.rockwellautomation.com/en_NA/capabilities/industrial-safety-solutions/overview.page?pagetitle=Safety-Automation-Builder&docid=ef863d3d3422316df38f212973b23076

http://www.literature.rockwellautomation.com/idc/groups/literature/documents/in/1770-in041_-en-p.pdf

https://rok.auto/certifications

Chapter 1

Digital Safety I/O Module Operation in a Control System

Topic Page

Overview 10

Overall System Safety Function 12

About the Modules 21

Local I/O Modules or Remote I/O Modules 23

Ownership 24

Construct a System 25

Configure the Modules 26

Input Module Operation 31

Output Module Operation 32

External Means 35

Protected Operations 36


Chapter 1 Digital Safety I/O Module Operation in a Control System

Overview GuardLogix® controllers use 1756-IB16S and 1756-OBV8S modules to control devices in a control system.

ControlLogix modules mount in a ControlLogix chassis, and require a removable terminal block (RTB) to connect all field-side wiring.

Table 1 - 1756 ControlLogix® Digital Safety I/O Modules

Module Type Cat. No. Description

Safety(1)

(1) You can use the safety modules in applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

1756-IB16S 18…32V DC 16-point sinking safety input module

1756-OBV8S 18…32V DC 8-point, safety output module that can be used as:• Bipolar output module• Sourcing output module

ATTENTION: The 1756-IB16S and 1756-OBV8S modules are compatible with a 1756 ControlLogix Chassis, Series C. Do not install the 1756-IB16S and1756-OBV8S modules in a 1756 ControlLogix Chassis, Series B.ATTENTION: Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module.

IMPORTANT A ControlLogix system with 1756-IB16S and 1756-OBV8S safety I/O modules has been agency certified using only the ControlLogix RTB catalog numbers 1756-TBCHS, 1756-TBNHS, 1756-TBSHS, and 1756-TBS6HS. Any application that requires agency certification of the ControlLogix system using other wiring termination methods can require application-specific approval by the certifying agency.

ATTENTION: To comply with the CE Low Voltage Directive (LVD), this equipment, and all connected I/O, must be powered from a safety extra low voltage (SELV) or protected extra low voltage (PELV) compliant source.For UL-compliant applications, the 1756-IB16S and 1756-OBV8S modules, and all connected IO, must be powered from a SELV or PELV-compliant power source that is rated 150VA maximum.

IMPORTANT All other I/O modules in the same chassis must use an SELV/PELV power supply.


Digital Safety I/O Module Operation in a Control System Chapter 1

Controller and Software Compatibility

Controller and programming software compatibility requirements apply when you use 1756 ControlLogix digital I/O modules.

Table 2 - Controller and Software Compatibility Requirements

Safety Modules Location Controller System Cat. Nos.

Supported Communication Protocol

Studio 5000 Logix Designer® application

1756-IB16S, 1756-OBV8S

Local GuardLogix 5580 1756-L81ES, 1756-L82ES, 1756-L83ES, 1756-L84ES, 1756-L8SP 1756 Backplane Version 32.00.00 or later, with Add-on Profile. Remote GuardLogix 5580 1756-L81ES, 1756-L82ES, 1756-L83ES, 1756-L84ES EtherNet/IP™

Compact GuardLogix 5380 5069-L306ERS2, 5069-L306ERMS2, 5069-L310ERS2, 5069-L310ERMS2, 5069-L320ERS2, 5069-L320ERS2K, 5069-L320ERMS2, 5069-L320ERMS2K, 5069-L330ERS2, 5069-5069-L330ERS2K, L330ERMS2, 5069-L330ERMS2K, 5069-L340ERS2, 5069-L340ERMS2, 5069-L350ERS2, 5069-L350ERS2K, 5069-L350ERMS2, 5069-L350ERMS2K, 5069-L380ERS2, 5069-L380ERMS2, 5069-L3100ERS2, 5069-L3100ERMS2



Overall System Safety Function

The following apply to the modules:• Type-approved and certified for use in safety applications up to and

including SIL 3 per IEC 61508• Suitable for use in safety applications up to and including SIL CL 3 per

IEC 62061• Suitable for use in safety applications up to and including Performance

Level e (PLe), category 4 per ISO 13849-1

Determine Conformity

IMPORTANT Functional safety certification and performance of 1756-IB16S and 1756-OBV8S modules requires that the modules operate in conditions at or below the ambient operating temperature specification. The probability of a dangerous failure on demand (PFD) and average frequency of a dangerous failure per hour (PFH) calculations for these modules are based on the module operating conditions adhering to the ambient operating temperature specification.For more information on the maximum ambient operating temperature specification, see the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002.

IMPORTANT Requirements are based on the standards current at the time of certification.For more information on safety application suitability levels:• 1756-IB16S Input Module Features on page 45• 1756-OBV8S Output Module Features on page 57

ATTENTION: Use only appropriate components or devices that comply with the relevant safety standards and meet the required safety integrity level or Performance Level and safety category.• Conformity to the requirements of the relevant safety standards must be

determined for the entire system by conducting a risk assessment.• Use devices properly according to the installation environment,

performance rating, and functions of the machine.• Use devices within their specified ratings.• We recommend that you consult a certification body regarding assessment

of conformity to the required safety integrity level or Performance Level.You are responsible for confirming compliance with the applicable standards for the entire system. You must read, understand, and fulfill the functional safety requirements of the standard applicable to your safety application.


http://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-p.pdf

13


Rockwell Automation Publication 1756-UM013B-EN-P - October 2019

The type approval, certification, and suitability levels for 1756-IB16S and 1756-OBV8S modules describe a system with an overall system safety function of SIL 3. However, you are not required to use 1756 ControlLogix digital safety I/O modules only in safety applications with an overall system safety function of SIL 3.

For example, a GuardLogix 5580 controller without a 1756-L8SP safety partner is suitable for use in safety applications that are rated up to, and including, SIL CL2, PLd, Cat. 3 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1. You can use 1756-IB16S and 1756-OBV8S modules in such an application.

GuardLogix 5580 controllers, when used with a 1756-L8SP safety partner are suitable for use in safety applications that are rated up to, and including SIL 3, and PLe, cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1. You can use 1756-IB16S and 1756-OBV8S modules in such an application.

For more information on the suitability level of Logix 5000™ safety controllers, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.



1756-IB16S Single-channel Point Operation Type

The1756-IB16S module is single-channel Point Operation Type only. The module channels are pre-configured and fixed at single channel Point Operation Type. The signal status of each channel is evaluated. Based on that status, safety input data and safety input status can be off or on.

To detect discrepancy faults between the channels of a dual channel safety device, use dual channel safety instructions the GuardLogix safety task, for example, the Dual Channel Input Stop (DCS) instruction.

1756-OBV8S Single-channel or Dual-channel Point Operation Type

You can use the 1756-OBV8S modules only in single-channel Point Operation Type while in bi-polar mode. Bi-polar single channel Point Operation Type consists of a P-M pair. P is the sourcing terminal, and M is the sinking terminal.

In sourcing mode, you can configure single channel or dual-channel Point Operation Type. In sourcing, dual-channel Point Operation Type, both channels must always be in the same logical state.

Dual-channel Point Operation Type is typically used when both safety outputs are controlling the same load. Rockwell Automation recommends configuring the module for dual-channel Point Operation Type in dual-channel applications because it decreases the dangerous undetectable failure rate (λDU) within the module.

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-MDC –

K

K

M



Obtain Firmware

Verify that the firmware revision of the 1756-IB16S and 1756-OBV8S modules that you use is correct before commissioning the system.

Firmware information for safety I/O devices is available at the Rockwell Automation Product Compatibility and Download Center (PCDC). The PCDC is available at:

https://compatibility.rockwellautomation.com/Pages/home.aspx

Only download firmware and access product release notes from the Rockwell Automation PCDC.

Do not download firmware from non-Rockwell Automation sites.

Safety Function During Firmware Update

The 1756-IB16S and 1756-OBV8S modules are not safety capable when a firmware update is in process. You must use other methods to maintain the safety function during the update process.

For information on how to maintain the safety function during the update process, for example, remove the module from service to perform the update, see the GuardLogix and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.





Safety Precautions

Observe these precautions for the proper use 1756 ControlLogix digital safety I/O modules.

For more information about safety precautions, see Ownership on page 24.

Installing and Replacing Modules

ATTENTION: Personnel responsible for the application of safety-related programmable electronic systems (PES) shall be aware of the safety requirements in the application of the system and shall be trained in the use of the system.

ATTENTION: As serious injury can occur due to loss of required safety function, follow these safety precautions.• Never use test outputs as safety outputs. Test outputs are not safety outputs.• Do not use standard I/O data or explicit message data as safety data.• Do not use the light-emitting diode (LED) status indicators on the I/O

modules for safety operations.• Do not connect loads beyond the rated value to the safety outputs.• Apply properly specified voltages to the module. Applying inappropriate

voltages can cause the module to fail to perform its specified function, which could lead to loss of safety functions or damage to the module.

• Wire the 1756 ControlLogix digital safety I/O modules as shown in the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002.

• Set unique network node addresses before you connect devices to the network.

• Perform testing to confirm that device wiring, configuration, and operation is correct before you start system operation.

• Do not disassemble, repair, or modify the module. This can result in loss of safety functions.

ATTENTION: • Configure the replacement device properly and confirm that it operates

correctly.• After installation of the module, a safety administrator must confirm the

installation and conduct trial operation and maintenance.


http://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-p.pdf


Safety Application Requirements

Safety application requirements include evaluating the following:• Probability of failure rates (PFD and PFH)• System reaction time settings• Functional verification tests that fulfill appropriate safety-level criteria

Creating, recording, and verifying the safety signature is also a required part of the safety application development process. The safety controller creates the safety signatures. The safety signature consists of an identification number, date, and time that uniquely identifies the safety portion of a project. This number includes all safety logic, data, and safety I/O configuration.

For safety system requirements, including information on the safety network number (SNN), verifying the safety signature, functional verification test intervals, system reaction time, and PFD/PFH calculations, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.

You must read, understand, and fulfill the requirements that are described in this publication before you operate a safety system that uses 1756 ControlLogix digital safety I/O modules.




Safe State

The following are the safe states of the safety modules:

• Safety outputs: OFF

• Safety input data to network: OFF

Figure 1 - Safety Status

The modules are designed for use in applications where the safe state is the off state.

ATTENTION: • The safe state of the outputs is defined as the off state.• The safe state of the module and its data is defined as the off state.• Use the 1756 ControlLogix digital safety I/O modules only in applications

where the off state is the safe state.

IMPORTANT If you inhibit a safety module from transitioning to a safe state when a fault occurs because an I/O connection is lost, you accept responsibility for any consequences that result from your decision to inhibit.We recommend that you use other means to maintain the safe state if you inhibit the safety module from transitioning to a safe state.

Output OFF

Networks Input to Networks OFF

Safety Status

Input



Configuration Signature and Ownership

Every 1756 ControlLogix digital safety I/O module in a system has a configuration signature and configuration ownership.

Configuration Signature

Each safety device has a unique configuration signature that defines the module configuration. The configuration signature includes the following:

• ID number

• Date

• Time

The configuration signature is used to verify a module’s configuration.

Configuration Ownership

The connection between the owner-controller and the 1756 ControlLogix digital safety I/O module is based on the following:

• 1756 ControlLogix digital safety I/O module node number

• 1756 ControlLogix digital safety I/O module safety network number

• Controller node or slot number

• Controller safety network number

• Path from the controller to the 1756 ControlLogix digital safety I/O module

• Configuration signature

If any differences are detected, the connection between the owner-controller and the 1756 ControlLogix digital safety I/O module is lost, the yellow yield icon appears in the controller project tree.

IMPORTANT If the owner-controller is a GuardLogix 5580 controller, the controller has a slot number.



Different Configuration Owner

When a controller owns the I/O module configuration, other controllers can listen to the input module. In this case, the module configuration signature in the Logix Designer application project for any listening controller must match the one in the owner-controller project.

Reset 1756 ControlLogix Digital Safety I/O Modules to Out-of-Box State

If a 1756 ControlLogix digital safety I/O module was used previously, you must clear the configuration ownership before you can install it on a safety network. That is, you must return the module configuration to its out-of-box state.

When a 1756 ControlLogix digital safety I/O module is in the out-of-box state, its configuration is not owned by a controller.

The Safety category on the Module Properties dialog box displays the module Configuration Ownership. The Logix Designer application project must be online to check.

If the module configuration is owned, the Safety category displays whether the controller for the opened project owns the module configuration or another controller owns it.

For information on how to reset the module in the Logix Designer application, see Reset to Out-of-Box Configuration on page 93.

You cannot reset the module to its out-of-box configuration if any of the following conditions exist:

• There are pending edits to the module properties.• When a safety signature exists in the controller project.

The I/O modules use removable terminal blocks (RTBs) to connect field-side wiring. You use the Studio 5000 Logix Designer application to configure the modules (see Controller and Software Compatibility on page 11).

The I/O modules use the Producer/Consumer network communication model. This communication is an intelligent data exchange between modules and other system devices in which each module produces data without first being polled.

TIP If the safety module is configured for inputs only, you can copy and paste the configuration signature from one project to the other.If the safety module has safety outputs, for example, the 1756-OBV8S module, the configuration signature parameter is disabled.



About the Modules Figure 2 below and Figure 3 on page 22 show the parts of a 1756 ControlLogix digital safety I/O modules.

Figure 2 - Example 1756-IB18S Module

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC INPUT

FLT

ST 8 9 10 11 12 13 14 15

8 9 10 11 12 13 14 15

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC INPUT

FLT

ST 8 9 10 11 12 13 14 15

8 9 10 11 12 13 14 15

3 5

6

421

7

Item Description

1 Backplane Connector—Interface for the ControlLogix system that connects the module to the backplane.

2 Top and bottom guides—Guides provide assistance in seating the RTB onto the module.

3 Status indicators—Indicators display the status of communication, module health, and input/output devices. Indicators help in troubleshooting anomalies.

4 Connector pins—Input/output, power, and grounding connections are made to the module through these pins with the use of an RTB.

5 Locking tab—The locking tab anchors the RTB on the module, maintaining wiring connections.

6 Slots for keying—Mechanically keys the RTB to help prevent making the wrong wire connections to your module.

7 Module with RTB installed



Figure 3 - Example 1756-OBV8S

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

3 5

6

421

7

Item Description

1 Backplane Connector—Interface for the ControlLogix system that connects the module to the backplane.

2 Top and bottom guides—Guides provide assistance in seating the RTB onto the module.

3 Status indicators—Indicators display the status of communication, module health, and input/output devices. Indicators help in troubleshooting anomalies.

4 Connector pins—Input/output, power, and grounding connections are made to the module through these pins with the use of an RTB.

5 Locking tab—The locking tab anchors the RTB on the module, maintaining wiring connections.

6 Slots for keying—Mechanically keys the RTB to help prevent making the wrong wire connections to your module.

7 Module with RTB installed



Local I/O Modules or Remote I/O Modules

You can use 1756 ControlLogix digital safety I/O modules as local or remoteI/O modules, with some restrictions that are based on the module and controller type. Compatibility requirements apply and are described in Controller and Software Compatibility on page 11.

Local I/O Modules

When I/O modules reside in the same system as the controller, the modules are local I/O modules.

Figure 4 - Local 1756 ControlLogix digital safety I/O modules

GuardLogix 5580 Controller1756-L8SP Safety Partner1756-IB16S Safety Input Module1756-OBV8S Safety Output Module

OK

NET

LINK

RUN

REMRUN PROG

FORCE SD OK

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC INPUT

FLT

ST 8 9 10 11 12 13 14 15

8 9 10 11 12 13 14 15



Remote I/O Modules

When 1756 ControlLogix digital safety I/O modules reside in a separate location from a GuardLogix 5580 or Compact GuardLogix 5380 controller, they are remote I/O modules.

Remote 1756 ControlLogix digital safety I/O modules are accessible over an EtherNet/IP network via a 1756 ControlLogix EtherNet/IP adapter.

Figure 5 shows remote safety I/O modules in a GuardLogix 5580 control application.

Figure 5 - Remote Safety I/O Modules in a GuardLogix 5580 Control Application

Ownership Every standard or safety I/O module in a GuardLogix 5580 control system must be owned by a controller, also known as the owner-controller.

1756 ControlLogix digital safety I/O modules digital input modules can only have one owner-controller. When a 1756 ControlLogix Digital Safety I/O Module is used in a GuardLogix 5580 control system, the owner-controller performs the following:

• Stores configuration data for every module that it owns.• Sends the I/O module configuration data to define module behavior and

begin operation in the control system.

Each I/O module must continuously maintain communication with its owner-controller during normal operation.

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

527

F1

F2

F3

F4

F5

F6

F7

F8

F9

F10

F11

F12

F13

F14

F15

F16

5069-OBV8S5069-IB8S 5069-IB8S 5069-OBV8S

OUTPUT OUTPUT

Compact 5000™ I/O

Compact 5000™ I/O

OK

Logix55L8SP™

NET

LINK

RUN

REM

RUN PROG

FORCE SD OK

Logix5584ES™ DC INPUT

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC INPUT

FLT

ST 8 9 10 11 12 13 14 15

8 9 10 11 12 13 14 15

GuardLogix 5580 Safety Controller1756-L8SP Safety Partner 1756 ControlLogix EtherNet/IP Adapter

1756 ControlLogix Safety I/O Modules

PanelView™ Plus 7 Terminal

Stratix® 5400 Switch

PowerFlex® 527 Drive Kinetix® 5500 Drive

Compact 5000™ I/O EtherNet/IP AdapterCompact 5000 I/O Safety Modules



Construct a System Before you install and use your module, you must do the following:• Install and ground a 1756 ControlLogix Series C chassis, and power

supply. To install these products, refer to the publications listed in Additional Resources on page 8.

• Order and receive an RTB and its components for your application. RTBs are not included with your module purchase.

1756 ControlLogix 16-point Sinking Safety Input Module (1756-IB16S) uses these RTBs:– 1756-TBCHS Cage-clamp removable terminal block with standard

housing, 36-pin – 1756-TBS6HS Spring-clamp removable terminal block with standard

housing, 36-pin– 1756-TBES Extended-depth terminal block housing. Requires the

underlying connector.

For how to assemble and wire the RTB, see the 1756 ControlLogix 16-point Sinking Safety Input Module Installation Instructions, publication 1756-IN079.

The 1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module (1756-OBV8S) uses these RTBs:– 1756-TBNHS Cage-clamp removable terminal block with standard

housing, 20-pin – 1756-TBSHS Spring-clamp removable terminal block with standard

housing, 20-pin– 1756-TBES Extended-depth terminal block housing. Requires the

underlying connector.

For how to assemble and wire the RTB, see the 1756 ControlLogix 8-point Safety Bipolar/Sourcing Output Module Installation Instructions, publication 1756-IN081.

Local I/O Modules

Complete the following:

1. Install a GuardLogix 5580 controller.

2. Install the modules.

ATTENTION: Due to the higher internal power dissipation of the 1756-OBV8S module, do not install the 1756-OBV8S module next to any controller or communication module.





Remote I/O Modules

Complete the following:

1. Install a GuardLogix 5580 controller.

2. Install an EtherNet/IP network.

3. Connect the controller to the network.

4. Install a 1756 ControlLogix EtherNet/IP adapter in the remote chassis.

5. Connect the adapter to the network.

6. Install the 1756 ControlLogix digital safety I/O modules.

For information on how to install compatible controllers, adapters, and I/O modules, see the publications that are listed in Additional Resources on page 8.

Configure the Modules You must create a Logix Designer application project for the controller that owns the 1756 ControlLogix digital safety I/O modules. The project includes module configuration data for the module.

The Logix Designer application transfers the project to the owner-controller during the program download. Data is then transferred to the I/O modules either across the backplane or over an EtherNet/IP network.

The I/O modules can operate immediately after receiving the configuration data.

IMPORTANT This section shows some Logix Designer application screens; it is not a complete description of how to configure a module.• For more information on how to use the Logix Designer application to

configure 1756 ControlLogix digital safety I/O modules, see Chapter 5, Configure and Replace Safety Modules on page 77.



Connections with 1756 ControlLogix Digital Safety I/O Modules

During module configuration, you must define the module. Among the Module Definition parameters with 1756 ControlLogix digital I/O modules, you must choose a connection type for the module. A connection is a real-time data transfer link between the owner-controller and the module that occupies the slot that the configuration references.

When you download module configuration to a controller, the controller attempts to establish a connection to each module in the configuration.

Because part of module configuration includes a slot number in the local or remote system, the owner-controller checks for the presence of a module there. If a module is detected, the owner-controller sends the configuration. One of the following occurs:

• If the configuration is appropriate to the module detected, a connection is made and operation begins.

• If the configuration is not appropriate to the module detected, the data is rejected and the Logix Designer application indicates that an error occurred.

The configuration can be inappropriate for many reasons. For example, a mismatch in electronic keying that prevents normal operation.

The owner-controller monitors its connection with a module. Any break in the connection, for example, the loss of power to the system, causes a fault. The Logix Designer application monitors the fault status tags to indicate when a fault occurs on a module.

During module configuration, you must define the module. Among the Module Definition parameters with 1756 ControlLogix digital safety I/O modules, you must choose how module is configured.

The choice depends on whether the project is downloaded to the controller that owns the module configuration, that is, the owner-controller, or to a controller that is listening to input modules in a project.

A real-time data transfer link is established between the controller and the module that occupies the slot that the configuration references.

When you download module configuration to a controller, the controller attempts to establish a connection to each module in the configuration.



Configured By Options Available with the 1756 ControlLogix Digital Safety I/O Modules

The Configured By choice determines what data is exchanged between the owner-controller and the module. These are example Module Definition dialog boxes, and available Connection choices, for the 1756-IB16S and 1756-OBV8S safety modules.

Table 3 describes the connection types that you can use with the 1756-IB16S and 1756-OBV8S safety modules.

1756-IB16S Module 1756-OBV8S Module

Table 3 - Configured By Choices - 1756-IB16S and 1756-OBV8S Safety Modules

Configured By Choice

Description

1756-IB16S Safety Input Module 1756-OBV8S Safety Output Module

This Controller The module returns the following to the owner-controller:• General fault data• Safety input data

The module returns the following to the owner-controller:• General fault data• Safety input data• Safety output dataWhen you choose This Controller, you must define the output mode that the module uses, that is, sourcing or bipolar output mode.

External Means When the External Means option is chosen, another controller listens to the data exchanged with the owner-controller. That is, it receives Safety input data. A controller with this option does not write configuration for the module. For more information on External Means, see External Means on page 35.



Data Types Available with 1756 ControlLogix Digital Safety I/O Modules

On the Module Definition dialog box for 1756 ControlLogix digital safety I/O modules, you must configure data type parameters.

Table 4 describes the available data type choices based on module type.

For information on the Data Types, see Module Tag Definitions on page 113.

Output Mode Available with 1756-OBV8S Safety Output Module

The Module Definition for the 1756-OBV8S safety output module includes the Output Mode parameter. This parameter defines whether the module is operating in Sourcing or Bipolar mode.

For more information on the Module Definition parameters that are available with 1756 ControlLogix digital safety I/O modules, see the Logix Designer application.

Table 4 - 1756 ControlLogix Digital Safety I/O Modules - Data Types

Catalog Number Supported Data Types Data Type Choices

1756-IB16S Input Data Safety DataSafety Packed Data

1756-OBV8S Input Data Safety DataSafety Packed Data

Output Data Safety DataSafety Packed Data

IMPORTANT If the Configured By parameter is External Means, the Output Mode parameter is disabled. It is automatically set to None.



Requested Packet Interval

The Requested Packet Interval (RPI) is a configurable parameter that defines a rate at which the owner-controller and the module exchange data.

You set the RPI value during initial module configuration and can adjust it as necessary after module operation has begun. Valid RPI values for 1756 ControlLogix Digital Safety I/O Modules are 2…500 ms.

Connection Reaction Time Limit With 1756 ControlLogix Digital Safety I/O Modules

With 1756 ControlLogix digital safety I/O modules, the Connection Reaction Time Limit configuration affects the module RPI.

The Connection Reaction Time Limit defines the maximum time that is allowed between valid safety packets on the associated connection. If the Max Network Delay exceeds the Connection Reaction Time Limit, a connection fault occurs.

By default, the Connection Reaction Time Limit is four times the RPI.

Use the default values for Timeout Multiplier (2) and Network Delay Multiplier (200). The Network Delay Multiplier value is in terms of percentage. Thus, 200 means 200%.

For more information on how to specify RPI rates, see page 85.

Also see:• GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems

Safety Reference Manual, publication 1756-RM012.• Logix 5000 Controllers Design Considerations Reference Manual,

publication 1756-RM094.

IMPORTANT You can change the RPI while the project is online. If you change the RPI while the project is online, however, the connection to the module is closed and reopened in one of the following ways:• You inhibit the connection to the module, change the RPI value, and

uninhibit the connection.• You change the RPI value. In this case, the connection is closed and

reopened immediately after you apply the change to the module configuration.

IMPORTANT To determine what is appropriate, analyze each safety channel. The default Timeout Multiplier of 2 and Network Delay Multiplier of 200 creates a worse-case input connection reaction time limit of 4 times the RPI, and an output connection reaction time limit of 3 times the RPI. Changes to these parameters must be approved only after a thorough review by a safety administrator.


https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm012_-en-p.pdf



Connection Over an EtherNet/IP Network

When you configure a remote safety module, you must configure the Connection over EtherNet/IP parameter in the configuration for the remote adapter that connects the I/O modules to the network. The configuration choice dictates how input data is transmitted over the network.

The 1756 ControlLogix digital safety I/O modules use one of the following methods to transmit data:

• Multicast - Data is sent to all network devices.

• Unicast - Data is sent to one or more controllers depending on module configuration.

Unicast is the default setting.

Input Module Operation Logix 5000 controllers do not poll the safety input modules for input data.

The data exchange process between the input modules and the controller differs based on whether the module is a local I/O module or remote I/O module.

Local 1756 ControlLogix Digital Safety Input Modules

Local 1756 ControlLogix digital safety input modules broadcast their input data, that is, channel and status data, to the system backplane at the time that is defined in the RPI.

At the RPI, the following events occur.

1. The local input module scans its channels for input data.

2. The module sends the data to the system backplane.

3. The controller receives the data immediately.

IMPORTANT 1756 ControlLogix digital safety input modules cannot trigger events.



Remote 1756 ControlLogix Digital Safety Input Modules

Remote digital safety input modules broadcast their input data to the backplane at the time that is defined in the RPI. The input data consists of channel and status data.

At the RPI, the following events occur.

1. The remote input module scans its channels for input data.

2. The module sends the data to the remote system backplane.

3. The EtherNet/IP adapter sends the data over the EtherNet/IP network.

4. One of the following:• When a GuardLogix 5580 or Compact GuardLogix 5380 controller is

directly connected to the EtherNet/IP network, it receives the input data immediately.

• When a GuardLogix 5580 controller is connected to the EtherNet/IP network through another communication module, the module sends the data to its backplane and the controller receives it.

Output Module Operation Logix 5000 controllers send data to safety output modules at the RPI. The RPI defines when the controller sends data to an output module and when the module echoes data.

At the RPI, not only does the controller send data to the output module, but also the output module sends data to the controller. For example, the output module sends an indication of the channel data quality.

The data exchange process between safety output modules and a controller differs based on whether the module is a local I/O module or remote I/O module.

IMPORTANT You cannot use Immediate Output (IOT) instructions in safety programs.

IMPORTANT The RPI for a safety output module is the Safety Task period. Safety output data is sent at the completion of the Safety Task scan.



Local Safety Output Modules

Local safety output modules receive output data from a controller and send data to the controller. The data exchange occurs over the system backplane.

Controller to Local Output Module Data Transmission

The controller broadcasts data to its local backplane at the RPI.

The safety outputs are sent to the safety output module at the end of safety task.

The safety output RPI is set by the safety task period.

These events occur when the controller sends data to a local safety output I/O module.

1. The controller sends data to system backplane at the RPI.

2. The local output module receives the data from the system backplane and behaves as dictated by its configuration.

Local Output Module to Controller Data Transmission

When a local safety output module receives new data and the requested data value is present on the RTB, the output module sends output readback status to the controller. The data value corresponds to the signal present at its terminals.

In addition to the output readback, the output module sends other data to the controller at the RPI. For example, the module alerts the controller if a short circuit condition exists on the module.

The following events occur when a local safety output module sends data to the controller at the RPI.

1. The module sends the data to the system backplane.

2. The controller receives the data immediately.

Remote Safety Output Modules

Remote safety output modules receive output data from a controller and send data to the controller. The data exchange occurs over an EtherNet/IP network.

Controller to Remote Output Module Data Transmission

The controller broadcasts data to its local backplane at the RPI. The owner-controller does not depend on the program scan to complete to send data.

IMPORTANT You cannot use Immediate Output (IOT) instructions in safety programs.



These events occur when the controller sends data to a digital safety output module.

1. Data is sent in one of the following ways:• If the controller is directly connected to the EtherNet/IP network, it

broadcasts data to the network.In this case, skip to step 3.

• If the controller is connected to the EtherNet/IP network via a communication module, the controller transmits the data to the backplane.In this case, proceed to step 2.

2. The EtherNet/IP communication module transmits the data to the EtherNet/IP network.

3. The EtherNet/IP adapter in the remote system receives the data from the network and transmits it to the system backplane.

4. The remote output module receives the data from the backplane and behaves as dictated by its configuration.

Remote Output Module to Controller Data Transmission

When a safety output module receives new data and the requested data value is present on the RTB, the output module sends output readback status to the controller. The data value corresponds to the signal present at its terminals.

In addition to the output readback, the output module sends other data to the controller at the RPI. For example, the module alerts the controller if a short circuit condition exists on the module.

The following events occur when a remote safety output module sends data to the controller at the RPI.

1. The module sends the data to the remote system backplane.

2. The EtherNet/IP adapter in the system sends the data over the EtherNet/IP network.

3. One of the following:• If the controller is directly connected to the EtherNet/IP network, it

receives the input data from the network without need for a communication module.

• If the controller is connected to the EtherNet/IP network through another communication module, the module transmits the data to its backplane and the controller receives it.



External Means Any controller in the system can listen to the data from an I/O module. An owner-controller, as described in Ownership on page 24, exchanges data with I/O modules.

Controllers that do not own a module but must listen to data from it use the following on the Module Definition dialog box:

• 1756 ControlLogix digital safety I/O modules - Configured By = External Means.

In this case, the ‘listening’ controller can only listen to input data. The listening controller does not own the module configuration or exchange other data with the module.

When the module is configured by External Means, you can disable the module configuration signature. This disables the configuration validation check when connections are made.

During the I/O configuration process, you can specify an External Means connection. For more information on Connection options, see Module Definition on page 84.

IMPORTANT Remember the following:• If a controller uses External Means, the connection can be Multicast or

Unicast. • Once a module has been configured by the owner-controller, External

Means connections can be created and maintained regardless of owner state.



Protected Operations To maintain the secure operation of your safety I/O modules, operations that can disrupt module operation are restricted based on the module operating mode.

Table 5 describes the restrictions.

Table 5 - Protected Operations on safety I/O modules

Current Module Operation

Activity

Firmware Update Request

Module Reset Request

Connection Request

Configuration Change

Connection or Data Format Change

Electronic Keying Change

RPI Change

Connection not running Accepted

Connection running Rejected Accepted(1) Accepted(2) Not allowed(3) Accepted(4)

Firmware update is in process Rejected

(1) Only requests for Listen Only connections are accepted.(2) Configuration change is accepted in the following scenarios:

- Changes are made in the Module Properties dialog box and you click Apply.- Changes are made in the Configuration tags and you send a Reconfigure Module MSG to the module.

(3) The difference between Rejected and Not allowed is that rejected activities can be attempted in the Logix Designer application but do not take effect. The activities that are not allowed, that is, attempts to change the Connection or Data Format used, do not occur in the Logix Designer application.For example, if you attempt to reset a module that is connected to the owner-controller, the Logix Designer application executes the request and alerts you that it was rejected. If you attempt to change the data format on a module that is connected to an owner-controller, the Logix Designer application does not execute the attempted change. The application only alerts you that the change is not allowed. In the case, if the change is attempted online, the Module Definition dialog box field that changes the data format is disabled.

(4) The change occurs after the connection is closed and reopened. You can close and reopen the connection in the following ways:- Change the project while it is offline and download the updated project before going online again.- Change the project while it is online and click Apply or OK in the Module Properties dialog box. In this case, before the change is made, a dialog box alerts you of the ramifications before the change is made.


Chapter 2

Features Common to 1756 ControlLogix Digital Safety I/O Modules

This chapter describes features that are common to 1756 ControlLogix® Digital Safety I/O Modules modules unless otherwise noted.

Some features are supported on all I/O modules and other features are specific to module types. The differences are indicated in feature descriptions.

Topic Page

Input Module Compatibility 38

Output Module Compatibility 38

Software Configurable 39

Module Data Quality Reporting 40

Fault and Status Reporting 41

Module Inhibiting 41

Electronic Keying 43

Module Firmware 44

Producer/Consumer Communication 44


Chapter 2 Features Common to 1756 ControlLogix Digital Safety I/O Modules

Input Module Compatibility Digital safety input modules interface to sensing devices and detect whether they are On or Off.

These input modules convert DC On/Off signals from user devices to appropriate logic level for use in the controller. Typical input devices include:

• Proximity switches• Limit switches• Selector switches• Float switches• Push button switches

When you design systems with a digital safety input module, consider these factors:

• Voltage necessary for your application• Current leakage• Whether you need a solid-state device• Whether your application uses sinking or sourcing wiring

Output Module Compatibility

You can use a digital safety output module to drive output devices. Typical devices compatible with these output modules include:

• Motor starters• Solenoids• Indicators

When you design systems with a digital safety output module, follow these guidelines:

• Make sure that the output modules can supply the necessary surge and continuous current for proper operation.

• Make sure that the surge and continuous current are not exceeded. Damage to the module could result.

When you size output loads, refer to the documentation supplied with the output device for the surge and continuous current necessary to operate the device.


Features Common to 1756 ControlLogix Digital Safety I/O Modules Chapter 2

Software Configurable You use the Studio 5000 Logix Designer® application to configure the module, monitor system operation, and troubleshoot issues. You can also use the Logix Designer application to retrieve this information from any module in the system:

• Serial number• Firmware revision information• Product code• Vendor• Error and fault information• Diagnostic information

By minimizing the need for tasks, such as setting hardware switches and jumpers, the software makes module configuration easier.



Module Data Quality Reporting

The digital safety I/O modules indicate the quality of channel data that is returned to the owner-controller. Data quality represents accuracy. Levels of data quality are reported via module input tags.

These input tags indicate the level of data quality.

• I.Ptxx.Fault - This tag indicates that the reported channel data is inaccurate and cannot be trusted for use in your application. Do not use the reported channel data for control.

If the tag is set to 1, you cannot trust the data reported. You must troubleshoot the module to correct the cause of the inaccuracy.

Example causes of inaccurate data include:– Field Power Loss condition (output modules) – Short Circuit condition (output modules)

We recommend that you troubleshoot the module for the typical causes first.

• I.Ptxx.Uncertain - This tag indicates that the reported channel data can be inaccurate but the degree of inaccuracy is unknown. We recommend that you do not use the reported channel data for control.

If the module sets this tag to 1, you know that the data can be inaccurate. You must troubleshoot the module to discover what degree of inaccuracy exists.

Example cause of uncertain data includes:– Module is operating outside its designed operating temperature range

IMPORTANT Once the condition that causes the Fault or Uncertain tag to change to 1 is removed, the tag automatically resets to 0. The Logix Designer application controls the tags. You cannot change the status of the tags.Keep in mind that in some system configurations, the tag is not reset immediately after the condition is removed. The tag typically resets after a small delay.

IMPORTANT We strongly recommend that you monitor the tags in your program to make sure that the application is operating as expected with accurate channel input data.



Fault and Status Reporting The digital safety I/O modules report fault and status data along with channel data. Fault and status data is reported in these ways:

• Logix Designer application

• Module status indicators

• I/O status indicators

For more information on fault and status reporting, see:

• Input modules - Fault and Status Reporting on page 54

• Output modules - Fault and Status Reporting on page 71

• Appendix A, Troubleshoot Your Module on page 103

Module Inhibiting Module inhibiting lets you indefinitely suspend a connection, including Listen Only connections, between an owner-controller and an I/O module without removing the module from the configuration. This process lets you temporarily disable a module, such as to perform maintenance.

You can use module inhibiting in these ways:

• You write a configuration for an I/O module but inhibit the module to help prevent it from communicating with the owner-controller. The owner does not establish a connection and the configuration is not sent to the module until the connection is uninhibited.

• In your application, a controller already owns a module, has downloaded the configuration to the module, and is exchanging data over the connection between the devices.

IMPORTANT Do not use the module status indicators or I/O status indicators on 1756 ControlLogix digital safety I/O modules for safety operations.

IMPORTANT You cannot inhibit a connection when the controller is safety-locked or a safety signature exists for the controller.



In this case, you can inhibit the module and the connection to the module does not exist.

You can use module inhibiting in these instances:• You want to update an I/O module, for example, update the module

firmware revision. Use this procedure.a. Inhibit the module.b. Perform the update.c. Uninhibit the module.

• You use a program that includes a module that you do not physically possess yet. You do not want the controller to look for a module that does not yet exist. In this case, you can inhibit the module in your program until it physically resides in the proper slot.

You can inhibit the connection to a 1756 ControlLogix digital safety I/O module on the Connection category of the Module Properties dialog box.

To see where to inhibit a connection, see Connection Category on page 85.

IMPORTANT Whenever you inhibit an output module that is ProgMode enabled, it enters Program mode, and all outputs change to the state configured for Program mode. For example, if an output module is configured so that the state of the outputs transition to zero during Program mode, whenever that module is inhibited, outputs transition to zero.



Electronic Keying Electronic Keying reduces the possibility that you use the wrong device in a control system. It compares the device that is defined in your project to the installed device. If keying fails, a fault occurs. These attributes are compared.

The following Electronic Keying options are available.

Carefully consider the implications of each keying option when selecting one.

More Information

For more detailed information on Electronic Keying, see Electronic Keying in Logix 5000™ Control Systems Application Technique, publication LOGIX-AT001.

Attribute Description

Vendor The device manufacturer.

Device Type The general type of the product, for example, digital I/O module.

Product Code The specific type of the product. The Product Code maps to a catalog number.

Major Revision A number that represents the functional capabilities of a device.

Minor Revision A number that represents behavior changes in the device.

Keying Option Description

Compatible Module

This is the default keying option. Compatible Module lets the installed device accept the key of the device that is defined in the project when the installed device can emulate the defined device. With Compatible Module, you can typically replace a device with another device that has the following characteristics:• Same catalog number• Same or higher Major Revision• Minor Revision as follows:

– If the Major Revision is the same, the Minor Revision must be the same or higher.– If the Major Revision is higher, the Minor Revision can be any number.

Exact Match Indicates that all keying attributes must match to establish communication. If any attribute does not match precisely, communication with the device does not occur. This is a suitable keying option for safety applications.

IMPORTANT Changing Electronic Keying parameters online interrupts connections to the device and any devices that are connected through the device. Connections from other controllers can also be broken.

If an I/O connection to a device is interrupted, the result can be a loss of data.


http://literature.rockwellautomation.com/idc/groups/literature/documents/at/logix-at001_-en-p.pdf



Module Firmware The digital safety I/O modules are manufactured with module firmware installed. If updated module firmware revisions are available in the future, you can update the firmware.

If the module is configured for Exact Match, the controller checks to make sure that the module has the correct firmware revision.

Updated firmware revisions are made available for various reasons, for example, to correct an anomaly that existed in previous module firmware revisions.

You access updated firmware files at the Rockwell Automation® Product Compatibility and Download Center (PCDC). The PCDC is available at:


Only download firmware and access product release notes from the Rockwell Automation® PCDC.

Do not download firmware from non-Rockwell Automation sites.

Producer/Consumer Communication

Digital safety I/O modules use the Producer/Consumer communication model to produce data without a controller polling them first. The modules produce the data, and the owner-controller (and controllers with a Listen Only connection to the module) can consume the data.

When an input module produces data, the controllers can consume the data simultaneously. Simultaneous data consumption minimizes the need for one controller to send the data to other controllers.

IMPORTANT Verify that the module firmware revisions for the 1756 ControlLogix digital safety I/O modules that you use are correct before commissioning your system.



Chapter 3

1756-IB16S Input Module Features

Overview This section describes features that are available on the 1756-IB16S module.

The following apply to the safety inputs:

• You can connect safety devices, such as Emergency Stop Push Button, gate switches, and safety light curtains.

• Evaluate an input signal, that is, input data, in single-channel mode or dual-channel mode.

• An external wiring short circuit check is possible when inputs are wired in combination with test outputs. The module must be wired in combination with test outputs when this function is used.

• Independently adjustable on and off delays are available per channel.

• Diagnostics.

• Safety input points are configured as:

– Not Used– Safety– Safety Pulse Test

Topic Page

Overview 45

Safety Application Suitability Level 46

Use Test Output with a Safety Input 47

Single-channel Point Operation Type 49

Safety Input Fault Reset 50

Safety Input Delay Time 50

Data Transfer at RPI 52

Module Health Diagnostic 52


Field Power Loss Detection 55

Short Circuit Protection 56


Chapter 3 1756-IB16S Input Module Features

The following apply to the test outputs:• Test outputs can be configured as:

– Not Used– Power Supply– Pulse Test

• Separate test outputs are provided for short circuit detection of a safety input (or inputs).

• Can supply 24V DC power to devices, such as safety sensors.

• Test output rating (TO) 200 mA @ 18…32V DC

Safety Application Suitability Level

Table 6 describes the safety application suitability levels for the 1756-IB16S module.

Table 6 - Safety Application Suitability for 1756-IB16S

Suitability Level Conditions Notes

Safety applications that are rated up to and including SIL CL3, PLd, Cat. 2 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1

The safety function uses single-channel mode.• Module channel Point Mode is Safety Pulse

Test.

Consider the following:• Single-channel mode and dual-channel mode, as stated in this table, refer to

the number of channels used in the safety function.• The 1756-IB16S module is capable of being a SIL CL3/PLe/Cat. 4 subsystem

(SRP/CS) when either a single-channel or dual-channel safety device is wired to the input channels.

• The channel mode type, that is, single or dual, affects Performance Level and Category. You can use the modules in SIL CL3 applications regardless of channel mode type.The determining factor to whether a 1756 ControlLogix® I/O safety module resides in a SIL CL3, PLe, Cat. 4 safety application is that the overall safety architecture be a dual-channel system.

• To achieve SIL CL3 single-channel, the sensor that is used must be SIL CL 3single-channel as well.

• The requirement that Point Mode be Safety Pulse Test assumes that only the safety modules provide diagnostics to a specific Suitability Level.The larger safety system within which the safety modules reside can provide the diagnostics necessary to achieve the stated Suitability Level without the requirement that Point Mode be Safety Pulse Test.

Safety applications that are rated up to and including SIL CL3, PLd, Cat. 3 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1

The safety function uses dual-channel mode(1). • Module channel Point mode is Safety.

Safety applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

The safety function uses dual-channel mode.• Module channel Point Mode is Safety Pulse

Test.The safety function uses dual-channel mode.• Module channel Point mode is Safety.• Use shredded cable or cable trunk to separate

channel wiring to mitigate short circuit faults.

(1) You cannot configure the module for dual-channel operation via the Logix Designer application module properties dialog box. You use dual-channel safety instructions in the Safety Task to provide cross monitoring.


1756-IB16S Input Module Features Chapter 3

Use Test Output with a Safety Input

A test output can be used in combination with a safety input for short circuit and cross-channel fault detection. In this case, Point Mode must be Safety Pulse Test. Safety input pairs must be associated with different Test Output sources.

When pulse testing is used, the only test source available for each channel is the test output to the left as shown on the wiring diagram.

Figure 6 - 1756-IB16S Module - Input Connected to Test Output

IMPORTANT Because of the pre-configured relationships between test outputs and input channels, wiring a dual channel device to input channels 0 and 8 is not supported if pulse testing is required, the same holds true for 1/9, 2/10, 3/11, 4/12, 5/13, 6/14, 7/15.

TIP The test output also can be configured as a power supply to source 24V DC to an external device, for example, a light curtain.

TO-1TO-2TO-3TO-4TO-5TO-6TO-7

IN-1IN-2IN-3IN-4IN-5IN-6IN-7IN-8IN-9IN-10IN-11IN-12IN-13IN-14IN-15DC(+)

DC(+)

DC(-)

DC(-)

TO-0TO-1TO-2TO-3TO-4TO-5TO-6TO-7

IN-0TO-0

+-

+-

Channel ConnectionsThe diagram shows devices that are connected to safety input channel 0 and test output channel 0. You can connect devices to all 16 channels.

2-wire sensor

3-wire sensor

24V DC SELV/PELV-listed

power supply



Figure 7 - 1756-IB16S Test Pulse in a Cycle

On the 1756-IB16S module, the test pulse width (X) is less than 600 µs; the test pulse period (Y) is less than 100 ms.

When the external input contact is closed, a test pulse is output from the test output terminal to diagnose the field wiring and input circuitry. By using this function, short-circuits between inputs and 24V power, and between input signal lines can be detected.

Figure 8 - Short Circuit Between Input Signal Lines

OUT

X Y

On

Off

24V DC

TO0

IN 0

IN +

COM

IN 1

TO1

24V DC

0V DC

External Contact

External Contact

Short circuit between input signal lines and power supply (positive side)

Short circuit between channels 0 and 1.



Single-channel Point Operation Type

If an error is detected on the input channel, Safety Input Data and Safety Input Status turn off.

For information on how using single-channel Point Operation Type with a 1756-IB16S module affects the safety application suitability level, see Table 6 on page 46.

Figure 9 - Normal Operation and Fault Detection (Not to Scale)

Normal Operation

Fault Detection

24V DC

0V DC

ON

OFF

ON

OFF

ON

OFF

ON

OFF

Safety Input 0 Data

Safety Input 0 Status

Test Output 0

External Device

Input Terminal 0

Safety Network Data Sent to the Controller

24V DC

0V DC

ON

OFF

ON

OFF

ON

OFF

ON

OFF

Safety Input 0 Data

Safety Input 0 Status

Test Output 0

External Device

Input Terminal 0


Fault Detected

Fault is declared at the end of the Test Output pulse.



Safety Input Fault Reset The I/O channel supports a module-level user-configurable 'Latch Fault until reset via output tag' mode and recovers from these faults:

• Field Power Off Detection• Safety Input Short Circuit

'Latch Fault until reset via output tag' mode is Enabled

When Latch Fault... mode is Enabled, the I/O channel holds safety input fault indications until it checks that the fault is removed. If the fault is removed, the channel clears the fault status only upon detecting that the ResetFault in its consume assembly channel sees a rising edge.

'Latch Fault until reset via output tag' mode is Disabled

When Latch Fault... mode is Disabled (default), the I/O channel holds safety input fault indications for 1 second until it checks if the fault is removed. If the fault is removed, the channel clears the fault status only upon detecting the safety input is low on the screw. If not, the channel continues to check if the fault is removed.

Safety Input Delay Time You can increase the time that it takes for an input point to transition from On to Off and Off to On on the 1756-IB16S module. The increase in time is a delay of the signal from the module to the controller.

The RPI defines a rate at which the owner-controller and the module exchange data (2…500 ms). For example, if you set the RPI at 10 ms and use an input delay time of 2 ms, it could take up to12 ms for a signal change to be seen at the controller.

An increase in the time it takes to transition from one state to another improves noise immunity within a signal.

To set the Input Delay Time on the 1756-IB16S module, see Edit the 1756-IB16S Module Configuration Categories on page 88.



Off to On Delay

An input signal is treated as Logic 0 during the Off to On delay time after the rising edge of the input contact.

The input turns on only if the input contact remains on after the Off to On delay time has elapsed. This setting help prevent rapid changes of the input data due to contact bounce.

You can delay the Off to On transition by the following times:• 0 ms• 1 ms• 2 ms• 5 ms• 10 ms• 20 ms• 50 ms

Figure 10 - Off to On Delay

ON

OFF

ON

OFF

Input Signal

Safety Input Network Data

Off to On Delay



On to Off Delay

An input signal is treated as Logic 1 during the On to Off delay time after the falling edge of the input contact.

The input turns off only if the input contact remains off after the On to Off delay time has elapsed. This setting helps to prevent rapid changes of the input data due to contact bounce.

You can delay the On to Off transition by the following times:• 0 ms• 1 ms• 2 ms• 5 ms• 10 ms• 20 ms• 50 ms

Figure 11 - On to Off Delay

Data Transfer at RPI The safety input module always sends data to the owner-controller at the RPI. You set the RPI on the Connection page of the Module Properties dialog box in the Logix Designer application.

Module Health Diagnostic Every I/O module has a status indicator on the front of the module that indicates module health.

For more information on status indicators, see Appendix A, Troubleshoot Your Module on page 103.

ON

OFF

ON

OFF

Input Signal

Safety Input Network Data

On to Off Delay



Point Diagnostics Point diagnostics provide information on an individual point basis. For example, you can check individual input points and test output points on a 1756-IB16S safety input module for the presence of a Short Circuit condition.

Figure 12 shows how to access output point diagnostics on the 1756-IB16S module and the diagnostics dialog box.

Figure 12 - Point Diagnostics



Fault and Status Reporting The input modules send fault and status data with channel data to the owner and listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application.

With some exceptions, the digital input modules provide the fault and data status in a point-centric format. The tag names that include Ptxx represent point-centric data in the table. The xx represents the point number.

Table 7 lists tags that are used on 1756-IB16S module.

For more information on fault reporting, see Appendix A, Troubleshoot Your Module on page 103.

IMPORTANT For more information on the valid values for each tag, see Appendix B, Module Tag Definitions on page 113.

Table 7 - 1756-IB16S Module - Fault and Data Status

Data Type Tag Name Triggering Event That Sets

Fault

ConnectionFaulted(1) The owner-controller loses its connection to the module.

Ptxx.Fault The point data quality is bad or the channel is set to Not Used.

Ptxx.ShortCircuit A short circuit condition exists on the point.

Testxx.Fault The point data quality is bad or the channel is set to Not Used.

Testxx.ShortCircuit A short circuit condition exists on the test point.

Testxx.FieldPowerOff A field power lost condition exists on the test point.

Status

RunMode The module is in Run Mode.

DiagnosticActive Indicates if any diagnostics are active or if the prognostics threshold is reached.

DiagnosticSequenceCount The count increments each time that a diagnostic condition is detected or removed.

Ptxx.Data The data currently at the point.

Ptxx.Uncertain The point data can be imperfect because an Over temperature or Critical Temperature condition exists.

Ptxx.Status The point state transitions from normal to faulted or faulted to normal.

Testxx.Readback A 24V DC power is present at the test output.

Testxx.Uncertain The test point data can be imperfect.

Testxx.Status The test point state transitions from normal to faulted or faulted to normal.

(1) This tag provides module-wide data an affects all channels simultaneously.



Field Power Loss Detection The Field Power Loss Detection feature monitors for the loss of field-side power.

When power is lost, the module detects the loss of field power and faults. As a result, fault data is sent to the controller. Keep in mind that all points on the module fault when a field power is lost.

Table 8 describes what happens when a field power loss condition is detected.

To correct the issue, you must reapply field power to the module.

Table 9 describes what happens when a field power is restored and the error latch time, if set, has expired.

Field Power Loss Detection has a corresponding tag that can be examined in the user program if a fault occurs. For information on modules, see Appendix B, Module Tag Definitions on page 113.

You can also monitor a point for the presence of a field power loss via the diagnostics that are available in the Module Properties dialog box in Logix Designer application.

Table 8 - Field Power Loss Detection - Condition Detected

Test Output Behavior

Tag Value Diagnostic Value I/O Status Indicator State

SA Status Indicator

• Faults• Turns off

• I.Testxx.FieldPowerOff tag = 1

• I.Testxx.Fault tag = 1

FieldPowerOff diagnostic = 1 Solid red Off

Table 9 - Field Power Loss Detection - Power Restored



SA Status Indicator

Restarts in its commanded state.

• I.Testxx.FieldPowerOff tag = 0

• I.Testxx.Fault tag = 0

FieldPowerOff diagnostic = 0 Off Steady green

IMPORTANT The module can require up to 1 second to complete the recovery in addition to the Input Error Latch Time.



Short Circuit Protection Short Circuit Protection helps to prevent damage to a test output that can result when more current is present at the output than it can handle. The diagnostic is supported on all module outputs.

Table 10 describes what happens when a short circuit condition is detected.

To correct the issue, remove the short.

Table 11 describes what happens when the short circuit condition is corrected.

For more information on the maximum current that you can apply to an output, see the ControlLogix I/O Modules Specifications Technical Data, publication 1756-TD002.

Test Output Recovery After Overload or Short Circuit to Ground Condition

Table 12 describes test output recovery after overload or short circuit to ground conditions occur.

Table 10 - Short Circuit Protection - Condition Detected




I.Testxx.ShortCircuit tag = 1I.Testxx.Fault tag = 1

Short Circuit diagnostic = 1 Flashing red

Table 11 - Short Circuit Protection - Condition Corrected




I.Testxx.ShortCircuit tag = 0I.Testxx.Fault tag = 0

Short Circuit diagnostic = 0 Turns off if there is no longer a load that is connected to the output.

Table 12 - Test Output Recovery - 1756 ControlLogix Digital Safety Input Modules

Cause of Fault Module Operating Conditions Correction Recovery Time

Overload Condition • Test Output Point Mode - Pulse Test, Power Supply

• Test Output Data tag = 1.• Overload current ≥ 0.7 A.

Remove the load from the test output point. After the condition is corrected, and the test output is returned to the safe state, it recovers in whichever of these times is higher:• 10 seconds• Input Error Latch Time - This time is set on

the Input Points category of the Module Properties dialog box.To see where to set the Input Error Latch Time, go to page 88.

Short Circuit to Ground Condition

• Test Output Point Mode - Pulse Test, Power Supply

• Test Output Data tag = 1.• Test output is connected directly to ground.

One of the following:• If the Point Mode for the test output is Pulse

Test or Power Supply when the Short Circuit condition is detected, the condition can be corrected but you cannot set the test output to a safe state.


http://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-e.pdf

Chapter 4

1756-OBV8S Output Module Features

This chapter describes features that are supported on the 1756-OVB8S output module.

Topic Page

Overview 58

Safety Application Suitability Level 59

Safety Output with Test Pulse 60

Single-channel Point Operation Type 61

Dual-channel Point Operation Type 62

Safety Output Fault Reset 63


Module Health Diagnostics 64

Field Power Loss Detection 66

No Load Detection 67

Short Circuit Protection 68

Thermal Shutoff 70


Configurable Channel-level Output State in Program Mode or Fault Mode 71

Connection Fault Handling 72

Forcing 73


Chapter 4 1756-OBV8S Output Module Features

Overview The 1756-OBV8S is a safety output module that uses eight safety outputs. You use the outputs in one of the following ways:

• Sourcing/sinking outputs in Bipolar Output mode• Sourcing outputs in Sourcing Output mode. • Solid-state outputs• Single-channel mode uses one output signal, that is, data from an output

channel, to provide control.

• Dual-channel mode uses two output signals, that is, data from two output channels to provide redundant control.

• Safety outputs can be pulse-tested to detect field wiring short-circuits to 24V DC.

• The 1756-OBV8S module follows the mode of the Safety Task, which can be different than the mode of the controller.

When the safety task encounters a nonrecoverable safety fault, a standard major recoverable fault is also logged, and the controller proceeds to execute the controller fault handler, if one exists. If the controller fault handler handles this fault, then the standard tasks continue to run, even though the safety task remains faulted.

If a recoverable fault occurs in the safety application, the system can halt the execution of the safety task, depending upon whether or not the fault is handled by Program Fault Routines in the safety application. If the recoverable safety fault is not handled, a standard major recoverable fault is also logged, and the controller proceeds to execute the controller fault handler, if one exists. If the controller fault handler handles this fault, then the standard tasks continue to run, even though the safety task remains faulted.

In these scenarios, the 1756-OBV8S module follows the Safety Task and will be in Program Mode/Communications Fault mode even though the controller is still in Run mode.

For information on Safety Faults, see the ControlLogix® 5580 and GuardLogix® 5580 Controllers User Manual, publication 1756-UM543.

IMPORTANT Single-channel mode is only certified for functional safety applications with process safety times greater than or equal to 200 ms; or, applications with demand rates less than or equal to 3 demand per minute.

IMPORTANT If there is a fault on a separate safety output on the same module, the module could switch off all outputs.




1756-OBV8S Output Module Features Chapter 4

Safety Application Suitability Level

Table 13 describes the safety application suitability levels for the 1756-OBV8S module.

Table 13 - Safety Application Suitability for 1756-OBV8S Module

Suitability Level Conditions Notes

Safety applications that are rated up to, and including, SIL CL3, PLd, Cat. 2 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

The safety function uses single -channel mode. • Module Output Mode is Sourcing• Module channel Point Operation Type is

SINGLE• Module channel Point mode is Safety Pulse

test.The safety function uses single-channel mode• Module Output Mode is bipolar• Module channel Point mode is Safety Pulse

test

Consider the following:• Single-channel mode refers to a single-channel actuator subsystem

driven by one sourcing output channel configured for SINGLE, or one bipolar output channel configured for SINGLE.

• Dual channel mode refers to a dual channel actuator subsystem driven by two sourcing output channels configured for DUAL, or one bipolar output channel configured for SINGLE.

• The 1756-OBV8S module is capable of being a SIL CL3/PLe/Cat. 4 subsystem (SRP/CS) when either a single-channel or dual-channel safety device is wired to the output channels.

• The channel mode type, that is, single or dual, affects Category and Performance Level. You can use the modules in SIL CL3, PLe applications regardless of channel mode type.The determining factor to whether a 1756 ControlLogix digital safety I/O module resides in a SIL CL3, PLe, Cat. 4 safety application is that the overall safety architecture be a dual-channel system.

• The requirement that Point Mode be Safety Pulse Test assumes that only the safety modules provide diagnostics to a specific Suitability Level.The larger safety system within which the safety I/O module resides can provide the diagnostics necessary to achieve the stated Suitability Level without the requirement that Point Mode be Safety Pulse Test.

Safety applications that are rated up to, and including, SIL CL3, PLe, Cat. 4 as defined in IEC 61508, IEC 61511, IEC 62061, and ISO 13849-1.

The safety function uses dual-channel mode. • Module Output Mode is Sourcing• Module Channel Point Operation Type is

DUAL• Module channel Point mode is Safety Pulse

test.The safety function uses dual-channel mode• Module Output Mode is bipolar• Module channel Point mode is Safety Pulse

test



Safety Output with Test Pulse

When the safety output is on, the safety output can be configured to pulse test the safety output channel. By using this function, you can continuously test the ability of the safety output to remove power from the output terminals of the module.

If an error is detected, the safety output data and individual safety output status turn off.

Figure 13 - 1756-OBV8S Test Pulse in a Cycle

On the 1756-OBV8S module, the pulse width (X) is less than 750 µs, and the pulse period (Y) is less than 96 ms.

TIP To help prevent the test pulse from causing the connected device to malfunction, pay careful attention to the input response time of the output device.An open wire test and main switch pulse test can also generate a pulse on a safety output even in safety mode.Two successive safety output pulses are required to determine if a short circuit fault exists. As a result, the effective pulse period is 192 ms, max.

OUT

X Y

On

Off

OUT

X YOff

On

Sourcing Output

Sinking Output



Single-channel Point Operation Type

When the output channel is in the On state and without any faults, the safety outputs turned on. The status is normal. If a fault is detected on the output channel, the safety output data and individual safety output status turn off.

For information on how using single-channel Point Operation Type with a 1756-OBV8S module affects the safety application suitability level, see Table 13 on page 59.

Figure 14 - 1756-OBV8S Single-channel Point Operation Type (Not to Scale)

Normal Operation

Fault Detection

ON

OFF

ON

OFF

ON

OFF

ON

OFF

Safety Output 0 Status

Output 0


Safety Output 0 Status

Output 0


Error Detected



Dual-channel Point Operation Type

When dual-channel Point Operation Type is used, output channels function as connection pairs. Connection pairs are as follows:

• Channels 0 and 1• Channels 2 and 3• Channels 4 and 5• Channels 6 and 7

When both output channels in a connection pair are in the On state and without any faults, the safety outputs are turned on.

For information on how to use dual-channel Point Operation Type with a 1756-OBV8S module affects the safety application suitability level, see Table 13 on page 59.

Figure 15 - 1756-OBV8S Dual-channel Point Operation Type (Not to Scale)

IMPORTANT Dual-channel Point Operation Type is only available if the module is connected so that Output Mode is Sourcing.

Normal Operation

Fault Detection

ON

OFF

ON

OFF

ON

OFF

Safety Outputs 0 and 1 Status

Output 0


Safety Outputs 0 and 1 Status

Output 1


Error Detected

ON

OFF

ON

OFF

ON

OFF

Output 0

Output 1



Safety Output Fault Reset The I/O channel supports a module-level user-configurable ‘Latch Fault until reset via output tag’ mode and recovers from only these field faults:

• Field Power Off Detection• Safety Output ShortCircuitGround• Safety Output Overload

The recovery time is 1 second for Field Power Off, and 10 seconds for Short or Overload.

‘Latch Fault until reset via output tag’ mode is Enabled

When Latch Fault... mode is Enabled, the I/O channel holds safety output fault indications until it checks that the field fault is removed. If the field fault is removed, the channel clears the fault status only upon detecting that the ResetFault in its consume assembly channel sees a rising edge.

‘Latch Fault until reset via output tag’ mode is Disabled

When Latch Fault... mode is Disabled (default), the I/O channel holds safety output fault indications for 1 second until it checks if the field fault is removed. If the field fault is removed, the channel clears the fault status only upon detecting the consume data bit is low. The fault status will also be cleared by a module reset or power cycle or when "Output State During Program Mode and Communications Fault Mode" is configured to Off and any of the following conditions:

• Controller in Program mode• Controller or Safety task fault• Communications fault• Module inhibit

After the channel clears the fault, the I/O indicator (red) turns off. The output data can now be controlled.

IMPORTANT If module outputs experience persistent high faults, consider cycling power to the module to clear the error.



Fault and Status Reporting The 1756-OBV8S module multicasts fault and status data with channel data to the owner and listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application.

For more information on how to use module tags to monitor fault and status reporting, see Table 24 on page 71

• Appendix A, Troubleshoot Your Module on page 103.

Module Health Diagnostics Each output module has a status indicator on the front of the module that indicates module health. For more information on module health diagnostics, see Appendix A, Troubleshoot Your Module on page 103.



Point Diagnostics Point diagnostics provide information on an individual point basis. For example, you can check individual points on a 1756-OBV8S safety output module for the presence of a Short Circuit condition.

To access output point diagnostics on the 1756-OBV8S module, click the Diagnostics button for the point.




Field Power Loss Detection The Field Power Loss Detection feature monitors for the loss of field power.

Keep in mind that all points on the module fault when a field power is lost.

Table 14 describes what happens when a field power loss condition is detected.

To correct the issue, you must reapply field power to the output module.

Table 15 describes what happens when a field power loss condition is resolved, and the module is recovered.

Field Power Loss Detection has a corresponding tag that can be examined in the user program if a fault occurs. For information on module tags, see Appendix B, Module Tag Definitions on page 113.

You can also monitor a point for the presence of a field power loss via the diagnostics that are available in the Module Properties dialog box in Logix Designer application.

IMPORTANT The 1756-OBV8S module supports Field Power Loss Detection.The module receives field-side power via the DC power terminals on the module. When field-side power is lost on the 1756-OBV8S, it is lost from the DC power terminals. See 1756-OBV8S Module Wiring Diagrams on page 123.

Table 14 - Field Power Loss Detection

Output Behavior



One of the following:• I.Ptxx.FieldPowerOff tag = 1• I.Ptxx.Fault tag = 1

FieldPowerOff diagnostic = 1 • Solid red

Table 15 - Field Power Loss Detection

Output Behavior



One of the following:• I.Ptxx.FieldPowerOff

tag = 0 • I.Ptxx.Fault tag = 0

FieldPowerOff diagnostic = 0 Off

IMPORTANT The module can require up to 2 seconds to complete the recovery.

IMPORTANT Keep in mind the following:• For the 1756-OBV8S module, Field Power Loss detection is in regard to

loss of field power on the DC power terminals, or the presence of Undervoltage or Overvoltage conditions on the DC Power bus.



No Load Detection No Load Detection detects when a wire is disconnected from the output, or a missing load for each output point in the Off state.

No Load Detection is enabled by default on the 1756-OBV8S modules. You cannot configure it.

The module supports these minimum load currents:

• Safety output modules - The load detection current is ≥10 mA. For example, 2.4 kΩ at 24V DC.

In the On state, the module must be connected to a load that draws a minimum current equal to these values.

Table 16 describes what happens when a No Load condition is detected.

Table 17 describes what happens when a No Load condition is corrected.

You can monitor a point for the presence of a No Load condition via the diagnostics page that is available in the Module Properties dialog box in Logix Designer application.

IMPORTANT An output must remain in the off state a minimum of 300 ms for an open load to be detected.

Table 16 - No Load Detection - 1756-OBV8S Module

Condition I/O Status Indicator State

No Load condition exists • Flashing red if a No Load condition exists and the output is off.• Flashing red/yellow if a No Load condition already exists and the output is

on.IMPORTANT: A No Load condition is only detected when the output is off.

Table 17 - No Load Detection - 1756-OBV8S Module

Condition I/O Status Indicator State

No Load condition corrected • Off if the output is off.• Steady yellow if the output is on.



Short Circuit Protection Short Circuit Protection helps to prevent damage to the output that can result when more current is present at the output than it can handle.

Table 18 describes what happens when a short circuit condition is detected on a 1756-OBV8S module.

Table 19 describes what happens when the short circuit condition is removed from a 1756-OBV8S module and the data is set to safe state, that is, the off state.

You can monitor a point for the presence of short circuit faults via the diagnostics page that is available in the Module Properties dialog box in Logix Designer application.

For more information on the maximum current that you can apply to an output, see the 1756 ControlLogix I/O Specifications Technical Data, publication 1756-TD002.

Table 18 - Short Circuit Protection - 1756-OBV8S Module

Output Behavior Tag Value Module Properties Points Tab Diagnostic Value

I/O Status Indicator State


One of the following:• If the output point is

shorted to 24V DC, the I.Ptxx.ShortCircuit tag = 1.

• If the output point is shorted to ground, no tags are changed.

One of the following:• If the output point was

shorted to 24V DC when the short circuit condition was detected, the Short Circuit diagnostic = Yes.

• If the output point is shorted to ground when the short circuit condition was detected, the Short Circuit to Ground diagnostic = Yes.

One of the following:• Flashes red if the

output point is shorted to 24V DC.

• Off if the output point is shorted to ground.

Table 19 - Short Circuit Protection - 1756-OBV8S Module

Output Behavior Tag Value Module Properties Points Tab Diagnostic Value

I/O Status Indicator State

Restarts in its commanded state

One of the following:• If the output point is

shorted to 24V DC, the I.Ptxx.ShortCircuit tag = 0.

• If the output point is shorted to ground, no tags are changed.

One of the following:• If the output point was

shorted to 24V DC when the short circuit condition was detected, the Short Circuit diagnostic = No.IMPORTANT: You must cycle power to the module to reset the diagnostic.

• If the output point is shorted to ground when the short circuit condition was detected, the Short Circuit to Ground diagnostic = No

Turns off if there is no longer a load that is connected to the output.


https://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-e.pdf


Other Conditions That Can Trigger the Short Circuit Diagnostic on the 1756-OBV8S Module

Table 20 describes conditions that can trigger the Short Circuit diagnostic.

When the conditions that trigger the diagnostics as described in Table 20 are corrected, the results are the same as described in Table 19 on page 68.

Table 20 - Conditions That Trigger Short Circuit Diagnostic

Conditions Output Behavior Tag and Diagnostic Combinations I/O Status Indicator State

• Output Mode - Sourcing• Point Operation Type - Single• Point Mode - Safety Pulse Test• O.Ptxx.Data tag = 1• Output point is shorted to 24V DC.


• I.Ptxx.ShortCircuit tag = 1• Short Circuit diagnostic = 1• I.Ptxx.Fault tag = 1

or

• I.Ptxx.Fault tag = 1• Internal Fault diagnostic = 1

IMPORTANT: The tag and diagnostic combinations that are described occur on the faulted output point and all of its associated group points.

The I/O status indicator for the faulted output point turns off.

These conditions exist on a pair of module outputs:• Output Mode - Sourcing• Point Operation Type - Dual• Point Mode - Safety Pulse Test• O.Ptxx.Data tag = 1 (Either output point in the pair)• Output point is shorted to 24V DC (Either output

point in the pair).


• I.Ptxx.ShortCircuit tag = 1• I.Ptxx.Fault tag = 1• Short Circuit diagnostic = 1• Internal Fault diagnostic = 1

or

• I.Ptxx.Fault tag = 1• Internal Fault diagnostic = 1

IMPORTANT: The tag and diagnostic combinations that are described occur on the faulted output point and all of its associated group points.

These conditions exist on a pair of module outputs:• Output Mode - Sourcing• Point Operation Type - Dual• O.Ptxx.Data tag = 1 (Both output points in the pair)• Output points are shorted to each other.


• I.Ptxx.ShortCircuit tag = 1 (Both output points in the pair)

• Short Circuit diagnostic = 1 (Both output points in the pair)

• I.Ptxx.Fault tag = 1

or

• I.Ptxx.Fault tag = 1 (Faulted output point and all of its associated group points)

• Internal Fault diagnostic = 1 (Faulted output point and all of its associated group points



Output Recovery After Overload or Short Circuit to Ground Condition

Table 21 describes test output recovery after overload or short circuit to ground conditions occur.

Thermal Shutoff Thermal Shutoff helps prevent damage to the output that can result when an output gets hotter than it can handle.

This feature is directly related to Short Circuit Protection feature. The increased temperature at the output results from an excessive load at the output. That is, a load with high current is applied to the output. The high current heats the output beyond an acceptable temperature and the output turns off.

Table 22 describes what happens when a thermal shutoff condition is detected on a 1756-OBV8S module.

Table 23 describes what happens when the thermal shutoff condition is corrected on a 1756-OBV8S module.

For more information on how to use the modules, see Appendix B, Module Tag Definitions on page 113.

Table 21 - Output Recovery - 1756-OBV8S Module

Cause of Fault Module Operating Conditions Correction Recovery Time

Overload Condition • Output Point Mode - Safety or Safety Pulse Test.

• Output Data tag = 1. • Overload current ≥1.5 A(1)

Remove the load from the output point. See Safety Output Fault Reset on page 63.

Short Circuit to Ground Condition

• Output Point Mode - Safety or Safety Pulse Test.

• Output Data tag = 1.• Output is connected directly to ground.

Remove the output connection to ground and set the output to a safe state.

(1) Do not use the module beyond the rated the capacity of 1 A per channel for continuous operation. For ratings, see the 1756 ControlLogix I/O Specifications Technical Data pub 1756-TD002.

Table 22 - Thermal Shutoff - 1756-OBV8S Module

Output Behavior Tag Value Diagnostic Value I/O Status Indicator State


One of the following:• If the output point is shorted to 24V DC when the thermal shutoff

condition occurred, the I.Ptxx.ShortCircuit tag = 1.• If the output point is shorted to ground when the thermal shutoff

condition occurred, there is no change to the tags.

One of the following:• If the output point is shorted to 24V DC when

the thermal shutoff condition occurred, there is no change in the diagnostics.

• If the output point is shorted to ground when the thermal shutoff condition occurred, the ShortCircuitGround diagnostic = 1.

Steady red

Table 23 - Thermal Shutoff - 1756-OBV8S Module

Output Behavior Tag Value Diagnostic Value I/O Status Indicator State

Remains in the off state I.Ptxx.ShortCircuit tag = 0 One of the following:• If the output point was shorted to 24V DC when the thermal shutoff

condition occurred, the Overload diagnostic = 0.IMPORTANT: You must cycle power to the module to reset the diagnostic.

• If the output point was shorted to ground when the thermal shutoff condition occurred, the ShortCircuitGround diagnostic = 0.

Turns off if there is no longer a load that is connected to the output.


https://literature.rockwellautomation.com/idc/groups/literature/documents/td/1756-td002_-en-e.pdf


Fault and Status Reporting The output modules multicast fault and status data with channel data to the owner and listening controllers. The data is returned via module tags that you can monitor in your Logix Designer application.

Table 24 lists tags that are used on the 1756-OBV8S module.

For more information on fault reporting, see Appendix A, Troubleshoot Your Module on page 103.

Configurable Channel-level Output State in Program Mode or Fault Mode

You can configure individual output channels to specific states when the module is in Program mode or Communications Fault mode. These output states are available:

• Off• Hold

To see how to configure the output states in Program mode or Fault mode, see Edit the 1756-OBV8S Module Points Category on page 90:

IMPORTANT For more information on the valid values for each tag in Table 24, see Appendix B, Module Tag Definitions on page 113.

Table 24 - 1756-OBV8S - Fault and Data Status

Data Type Tag Name Triggering Event That Sets

Fault

ConnectionFaulted(1) The owner-controller loses its connection to the module.

Ptxx.Fault The point data quality is bad or the channel is set to Not Used.

Ptxx.ShortCircuit A short circuit condition exists on the point.

Ptxx.FieldPowerOff A field power lost condition exists on the point.

Status

RunMode The module is in Run Mode.

DiagnosticActive Indicates if any diagnostics are active or if the prognostics threshold is reached.

DiagnosticSequenceCount The count increments each time that a diagnostic condition is detected or removed.

Ptxx.Readback A 24V DC power source is connected to the output circuit.

Ptxx.Uncertain The point data can be imperfect.

Ptxx.Status The point state transitions from normal to faulted or faulted to normal.

(1) This tag provides module-wide data an affects all channels simultaneously.

WARNING: The selection of “Hold” for Output State During Program Mode and Communications Fault Mode prevents the output point from going to the safe state, making the output point not suitable for a SIL or PL rated safety function. Set Output State During Program Mode and Communications Fault Mode to "Off" to allow points to go to safe state.TÜV Rheinland has approved GuardLogix 5580 and Compact GuardLogix 5380 controller systems for use in safety-related applications where the de-energized state is always considered to be the safe state. You must ensure each configuration of the safety IO module is set for "Off" under the Output State During Program Mode and Communications Fault Mode selection to consider those output points as part of any equipment's safety function.



Connection Fault Handling You can configure module behavior when a connection fault occurs, that is, the connection between the owner-controller and the output module breaks. You must define the immediate output behavior when the connection breaks.

Output Behavior Immediately After a Connection Fault

When the connection between an owner-controller and output module breaks, the output can behave in these ways, depending on how the Fault Mode parameter is configured:

• Turn off - Default• Hold its last state

If you configure the output to hold its last state, the output remains at that state value until this occurs:

• The connection to the owner-controller is re-established.• The output returns to normal operation, as defined in the module

configuration.

Output State Once Connection is Re-established

Once the connection between the owner-controller and output module is re-established, the output resumes normal operation.

ATTENTION: If you change the Output state from OFF to HOLD during Program or Communication Fault modes, make sure this does not create an unsafe state of your safety system.



Forcing Use a force to override data that your logic either uses or produces.

• Test and debug your logic.

• Temporarily maintain normal system operations when an input device has failed.

Use forces only as a temporary measure. They are not intended to be a permanent part of your application.

Make sure that you understand this before you use forces.

Enable Forces

For a force to take effect, you enable forces. You can only enable and disable forces at the controller level.

• You can enable I/O forces and SFC forces separately or simultaneously.

• You cannot enable or disable forces for a specific module, tag collection, or tag element.

IMPORTANT When a safety signature exists, forcing safety I/O is not permitted in the safety portion of the application.

ATTENTION: Forcing can cause unexpected machine motion that could injure personnel. Before you use a force, determine how the force affects your machine or process and keep personnel away from the machine area.• Enabling I/O or SFC forces causes your machine or process to go to another

state or phase.• Removing forces can still leave forces in the enabled state.• If forces are enabled and you install a force, the new force immediately

takes effect.



Disable or Remove a Force

To stop the effect of a force and let your project execute as programmed, disable or remove the force.

• You can disable or remove I/O and SFC forces simultaneously or separately.

• When you remove a force on an alias tag, you also remove the force on the base tag.

Check Force Status

Before you use a force, determine the status of forces for the controller.

The Online toolbar shows the status of forces. It shows the status of I/O forces and SFC forces separately.

ATTENTION: Changes to forces can cause unexpected machine motion that could injure personnel. Before you disable or remove forces, determine how the change affects your machine or process and keep personnel away from the machine area.

To determine the status of this Use any of these

I/O forces • Online toolbar• GSV instruction

SFC forces Online toolbar

Forces Tab Status Means

Enabled • If the project contains any forces of this type, they are overriding your logic.

• If you add a force of this type, the new force immediately takes effect

Disabled Forces of this type are inactive. If the project contains any forces of this type, they are not overriding your logic.

Installed At least one force of this type exists in the project.

None Installed No forces of this type exist in the project.

Forces tab



GSV Instruction

This example shows how to use a GSV instruction to get the status of forces. For the purposes of this example, Force_Status is a DINT tag.

To determine this Examine this bit For this value

Forces are installed. 0 1

No forces are installed. 0 0

Forces are enabled. 1 1

Forces are disabled. 1 0



Notes:


Chapter 5

Configure and Replace Safety Modules

This chapter describes how to configure your 1756 ControlLogix® Digital Safety I/O Modules in a Studio 5000 Logix Designer® application project.

This chapter does not explain the user-configurable parameters, or corresponding module features, in your Logix Designer application project.

For detailed information about module features, see the following:

• Chapter 2, Features Common to 1756 ControlLogix Digital Safety I/O Modules on page 37

• Chapter 3, 1756-IB16S Input Module Features on page 45

• Chapter 4, 1756-OBV8S Output Module Features on page 57

Topic Page

Create a New Module 78

Edit the Module Configuration Common Categories 82

Edit the 1756-IB16S Module Configuration Categories 88

Edit the 1756-OBV8S Module Points Category 90

View the Module Tags 92

Replace a Safety Module 93

IMPORTANT You must use the Logix Designer application, version 32 or greater with the modules.By default, all safety input and output channels on 1756 ControlLogix Digital Safety I/O Modules are disabled. You must configure each point that is used in a Safety application.


Chapter 5 Configure and Replace Safety Modules

Create a New Module The project must be offline to add safety modules to it.

You can create a new local or remote safety module. Local I/O modules are installed in the same system as the GuardLogix® 5580 controllers. Remote I/O modules are installed in a system that includes a 1756 ControlLogix EtherNet/IP™ adapter that connects to an EtherNet/IP network.

New Local Safety Module

To create a new local safety I/O module, complete these steps.

1. Create a Logix Designer application project.

2. Right-click the 1756 Backplane and choose New Module.


Configure and Replace Safety Modules Chapter 5

3. At the Select Module Type window, click Create to add the discovered module to your project.

4. At the New Module window, configure the module properties and click OK.

Follow the same steps to add additional local I/O modules.



New Remote I/O Module

To create a new remote safety I/O module, complete these steps.

1. Add a ControlLogix EtherNet/IP adapter to the project.

2. Right-click the EtherNet/IP adapter and choose New Module.

3. Select the module and click Create.

The New Module dialog box appears with a list of categories on the left side. The number and type of categories varies by module type.



4. You can click OK to use the default configuration as shown or edit the module configuration. The rest of this chapter describes how to edit module configuration categories.

Follow the same steps to add additional remote I/O modules.



Edit the Module Configuration Common Categories

You click the category names in the New Module dialog box to view and change the configuration parameters. Before you edit the module configuration, consider the following:

• This chapter shows how to edit the module configuration when you add the module to the Logix Designer application project.

If you access the module configuration after it is added to the project, the dialog box is named Module Properties. The same categories are displayed as the categories displayed on the New Module dialog box.

• Some new module configuration categories apply to all 1756 ControlLogix digital safety I/O modules. Some categories are specific to the module type.

The following categories apply to all 1756 ControlLogix digital safety I/O modules and are described in this section.

• General Category

• Connection Category

• Safety Category

• Module Info Category

IMPORTANT By default, all safety input and output channels on 1756 ControlLogix digital safety I/O modules are disabled.You must configure each point that is used in a Safety application.



General Category

The General category appears first when you create a module. The parameters in this category are the same for all 1756 ControlLogix digital safety I/O modules.

You use this category to complete the following tasks:• Name the module.• Assign a node number.• Describe the module.• Access the Module Definition.

Safety Network Number

The Logix Designer application automatically assigns a Safety Network Number (SNN) to safety modules as they are added to the project.

The SNN is a time-based number that uniquely identifies subnets across all networks in the safety system. All 1756 ControlLogix digital safety I/O modules in the same subnet use the same SNN by default.

• Local 1756 ControlLogix digital safety I/O modules are automatically assigned the same SNN as the 1756 Backplane SSN in the controller configuration.

• Remote 1756 ControlLogix digital safety I/O modules are automatically assigned the same SNN.

The Logix Designer application assigns an SNN to the first safety module that is added to a remote system. The application assigns the same SNN to additional safety modules that are added to this remote I/O system.

For more information on Safety Network Numbers, see the GuardLogix 5580 and Compact GuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.


https://literature.rockwellautomation.com/idc/groups/literature/documents/rm/1756-rm012_-en-p.pdf


Module Definition

Module Definition parameters are available on the General tab of the Module Properties dialog box in the Logix Designer application project. Table 25 describes the parameters on the Module Definition dialog box.

Table 25 describes the parameters on the Module Definition dialog box.

1756-IB16S 1756-OBV8S

Table 25 - Module Definition Parameters

Parameter Definition Available Choices

Series Module hardware series Module-specific

Revision Module firmware revision, including major and minor revision levels Module-specific

Electronic Keying Software method by which you reduce the possibility of using the wrong device in a control system.For more information, see the following:• Electronic Keying on page 43• Electronic Keying in Logix5000 Control Systems Application Technique, publication LOGIX-AT001

• Exact Match• Compatible Module

Configured By Determines the following for the module type you configure:• Which controller tags are generated when configuration is complete• Whether you can choose an Output Data type - Output module only• Whether you can choose an Output Mode - Output module only

• This Controller• External Means(1)

Input Data Determines what type of input data is exchanged between the module and the controller.Creates all controller tags specific to the module type being used.IMPORTANT: The 1756-OBV8S output module exchanges input data with the controller.

• Safety data• Safety packed data

Output Data - 1756-OBV8S module only

Determines what type of output data is exchanged between the module and the controller.The available choices are dictated by the Configured By parameter choice.

• None - If Configured By is External Means.

• Safety data and Safety packed data - If Configured By is This Controller.

Output Mode - 1756-OBV8S Determines how the outputs are used. That is, one of the following:• Sourcing outputs. In this case, you connect the external device to only the sourcing point on an output

channel.• As connection pairs. In this case, you connect the external device to both the sourcing and sinking points

of the bipolar output pair.

• Sourcing• Bipolar

(1) Controller and module establish communication without the controller sending any configuration or output data to the module. A full input data connection is established but depends on the connection between the owner-controller and the module.




Connection Category

The Connection category lets you inhibit the module.

Before you inhibit the module, make sure that you are aware of the impact it has on your application. For more information on inhibiting the module, see page 41.

Remote safety modules support the Connection over EtherNet/IP parameter. • With safety input data, you can choose Unicast or Multicast.• With safety output data, you must use Unicast.

For more information, see page 31.

IMPORTANT You cannot set the Requested Packet Interval (RPI) for the safety modules on the Connections category. For safety modules, you set the RPI on the Safety category.



Safety Category

The Safety category lets you set the RPI rate. You must click the Advanced button to change the Connection Reaction Time Limit configuration.

For more information on the RPI and the Connection Reaction Time Limit parameters, see Requested Packet Interval on page 30.

IMPORTANT Remember, the Safety Task period determines the 1756-OBV8S module RPI.



Module Info Category

The Module Info category displays module and status information about the module when the project is online. You can use this category to complete the following:

• Determine the identity of the module.

• Access module diagnostics.

• Refresh the data on the screen.

• Reset the module.



Edit the 1756-IB16S Module Configuration Categories

These categories are available when you configure a 1756-IB16S module:• Input Points Category• Test Output Points Category

Input Points Category

The Input Points category is only available if you choose This Controller for the Configured By parameter on the Module Definition dialog box. You must configure each point to use it in a Safety application. The inputs are disabled by default.

Point Mode

Determines the operation mode of the output point. • Not Used - The output point is disabled.• Safety - The output point is enabled.• Safety Pulse Test - The output point is enabled and a pulse test is

periodically performed on the output to make sure the output is functioning. The pulse test only occurs when the point is On. The pulse has a fixed state of periodic.

The default value is Not Used.

Test Source

Displays the Test Source values. There is a value for each point, 00-15. When Safety Pulse Test is selected in Point Mode, the value appears according to the point number.

Input Delay Time (ms)

For more information on input delay times, see page 50.



Test Output Points Category

The Test Output Points category is only available if you choose This Controller for the Configured By parameter on the Module Definition dialog box.

You must configure each point to use it in a Safety application. The outputs are disabled by default.

Point Mode

Determines the mode of the test output for the point. • Not Used - Test output is not used. • Pulse Test - Use the test output point as a pulse test source.• Power Supply - Use the test output as a power supply.



Edit the 1756-OBV8S Module Points Category

To use the Points category, on the Module Definition dialog box choose Configured By > This Controller.

The outputs are disabled by default. To use an output in a Safety application, you must configure the Point Operation Type and Point Mode. Optionally, you can configure the Output State During Program Mode and During Communications Fault Mode (Off, Hold)

IMPORTANT If you configure the output state to be Hold, then the output channel cannot be used in a safety application.

WARNING: The selection of “Hold” for Output State During Program Mode and Communications Fault Mode prevents the output point from going to the safe state, making the output point not suitable for a SIL or PL rated safety function. Set Output State During Program Mode and Communications Fault Mode to "Off" to allow points to go to safe state.TÜV Rheinland has approved GuardLogix 5580 and Compact GuardLogix 5380 controller systems for use in safety-related applications where the de-energized state is always considered to be the safe state. You must ensure each configuration of the safety IO module is set for "Off" under the Output State During Program Mode and Communications Fault Mode selection to consider those output points as part of any equipment's safety function.



Point Operation Type

Single

When the output channel is in the On state and without any faults, the safety outputs turned on. The status is normal. If a fault is detected on the output channel, the safety output data and individual safety output status turn off. See Single-channel Point Operation Type on page 61.

Dual

When dual-channel Point Operation Type is used, output channels function as connection pairs. Connection pairs are as follows:

• Channels 0 and 1• Channels 2 and 3• Channels 4 and 5• Channels 6 and 7

When both output channels in a connection pair are in the On state and without any faults, the safety outputs are turned on. See Dual-channel Point Operation Type on page 62.

Point Mode

Determines the operation mode of the output point. • Not Used - Output is not used.• Safety - Output is a safety output.• Safety Pulse Test - Tests the safety output itself using an internally

generated test pulse. Pulse testing detects shorts to the 24V power supply and channel-to-channel shorts. The pulse test only occurs when the point is On. The pulse has a fixed state of periodic.

Output State During Program Mode and Communications Fault Mode

You can select the output state (Off or Hold) for each channel to change to during:

• Program Mode and you encounter a Communications Fault.• Run Mode and you encounter a Communications Fault.



View the Module Tags When you create a module, the Logix Designer application creates a set of tags that you can view in the Tag Editor. Each configured feature on your module has a distinct tag that is available for use in the controller program logic.

Complete the following steps to access the tags for a module.

1. In the Controller Organizer, right-click Controller Tags and choose Monitor Tags.

The Controller Tags dialog box appears with data.

2. To view the tags, click the triangle symbols.

For more information on module tags, see Appendix B,Module Tag Definitions on page 113.



Replace a Safety Module Replacing a safety module that sits on a CIP Safety™ network is more complicated than replacing standard devices because of the Safety Network Number (SNN).

Safety devices require this more complex identifier to make sure that module numbers that are duplicated on separate subnets across all of the networks in the application do not compromise communication between the correct safety devices.

The SNN is a unique identifier that is automatically assigned to each subnet in a safety application. The same SNN is assigned to all of the devices on the subnet.

For example, when an EtherNet/IP adapter is used in a safety application, the Logix Designer application project assigns it an SNN. All safety modules that are installed with that adapter, are automatically assigned the same SNN.

However, each safety module requires a unique identifier within the same subnet. A DeviceID is used to uniquely identify each safety module. The SNN and module slot number make up the DeviceID of the safety module.

Reset to Out-of-Box Configuration

When the Logix Designer application is online, the Safety tab of the Module Properties dialog box displays the current configuration ownership. When the opened project owns the configuration, Local is displayed.

When a second device owns the configuration, Remote is displayed, along with the SNN, and node address or slot number of the configuration owner. Communication error is displayed if the module read fails.

If the connection is Local, you must inhibit the module connection before you reset ownership. To inhibit the module:

1. Right-click the module and choose Properties.

2. On the Connection tab, click Inhibit module.

3. Click Apply and then OK.



Follow these steps to reset the module to its out-of-box configuration when online.

1. Right-click the module and choose Properties.

2. On the Safety tab, click Reset Ownership.

3. When a dialog box appears asking if you want to continue with the reset, read it and click Yes.



Replace a Module in a Logix 5000 System

Consider the following conditions before you replace a safety module in a Logix 5000™ system:

• If you rely on a portion of the CIP Safety system to maintain SIL 3 behavior during module replacement and functional testing, you must use the Configure Only When No Safety Signature Exists feature.

• If there is only one safety controller on the network, or if you do not rely on the entire routable CIP Safety control system to maintain SIL 3/PL (d or e) during the replacement and functional testing of a module, you can use the Configure Always feature.

Replacement with `Configure Only When No Safety Signature Exists’ Enabled

When a module is replaced, the configuration is downloaded from the safety controller if the DeviceID of the new module matches the original. The DeviceID is updated whenever the SNN is set.

If the project is configured with Configure Only When No Safety Signature Exists enabled, follow the appropriate instructions in to replace a 1756 ControlLogix digital safety I/O module.

After you complete the steps in a scenario correctly, the DeviceID matches the original. This match enables the safety controller to download the proper module configuration, and re-establish the safety connection

Table 26 - Replacing a Module

GuardLogix® Safety Signature Exists

Replacement Module Condition

Action Required

No No SNN (Out-of-box) None. The device is ready for use.

Yes or No Same SNN as original safety task configuration

None. The device is ready for use.

Yes No SNN (Out-of-box) See Scenario 1 - Replacement Device is Out-of-box and Safety Signature Exists on page 96.

YesDifferent SNN from original safety task configuration

See Scenario 2 - Replacement Device SNN is Different from Original and Safety Signature Exists on page 98.

No See Scenario 3 - Replacement Device SNN is Different from Original and No Safety Signature Exists on page 101.



Scenario 1 - Replacement Device is Out-of-box and Safety Signature Exists

1. Remove the old I/O device and install the new device.

2. Right-click the replacement safety I/O device and choose Properties.

3. On the General category, click to the right of the safety network number to open the Safety Network Number dialog box.

4. Click Set.



5. Click Yes on the confirmation dialog box to set the SNN and accept the replacement device.

6. Follow your company-prescribed procedures to functionally test the replaced I/O device and system and to authorize the system for use.



Scenario 2 - Replacement Device SNN is Different from Original and Safety Signature Exists


2. Right-click your safety I/O device and choose Properties.

3. Click the Safety tab.

4. Click Reset Ownership.

5. On the Logix Designer application Dialog, click Yes.

6. On the next Logix Designer application Dialog, click Yes.



7. The Configuration Ownership now shows Not Owned.

8. Click the module General category.

9. Click to the right of the safety network number to open the Safety Network Number dialog box.



10. Click Set.

11. Click Yes on the confirmation dialog box to set the SNN and accept the replacement device.




Scenario 3 - Replacement Device SNN is Different from Original and No Safety Signature Exists


2. Right-click your safety I/O device and choose Properties.



5. On the Logix Designer application Dialog, click Yes.

6. On the next Logix Designer application Dialog, click Yes.




Replacement with ‘Configured Always’ Enabled

When the ‘Configure Always’ feature is enabled, the controller automatically checks for and connects to a replacement module that meets all the following requirements:

• The controller has configuration data for a compatible module at that network address.

• The module is in out-of-box condition or has an SNN that matches the configuration.

If the project is configured for ‘Configure Always’, follow the appropriate steps to replace a safety module.

1. Remove the old I/O module and install the new module.

2. Right-click your I/O module and choose Properties.



5. Click OK.

6. Follow your company-prescribed procedures to functionally test the replaced I/O module and system and to authorize the system for use.

ATTENTION: Enable the ‘Configure Always’ feature only if the entire CIP Safety Control System is not being relied on to maintain SIL 3 behavior during the replacement and functional testing of a module.Do not place modules that are in the out-of-box condition on a CIP Safety network when the Configure Always feature is enabled, except while following this replacement procedure.

If Then

the module is in out-of-box condition go to step 6.No action is needed for the controller to take ownership of the module.

an SNN mismatch error occurs (because the module was previously owned)

go to the next step to reset the module to out-of-box condition.


Appendix A

Troubleshoot Your Module

You can use the module status indicators and the Studio 5000 Logix Designer® application to troubleshoot the I/O modules.

Module Status Indicators 1756 ControlLogix® digital safety I/O modules use these status indicators:

Topic Page

Module Status Indicators 103

Use the Logix Designer Application for Troubleshooting 105

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

DC INPUT

FLT

ST 8 9 10 11 12 13 14 15

8 9 10 11 12 13 14 15

DC OUTPUT

SAFETY

FLT

ST 0 1 2 3 4 5 6 7

0 1 2 3 4 5 6 7 OK

I/O Status (ST) and Fault Status (FLT)

Indicators

Module OK Status Indicator

Module OK Status Indicator

I/O Status (ST) and Fault Status (FLT)

Indicators


Appendix A Troubleshoot Your Module

OK Status Indicators

The OK status indicator shows the module status.

Table 2 describes the I/O Status (ST) and Fault Status (FLT) status indicators.

Table 1 - Module OK Status Indicator

Indicator State Description

Off There is no module power applied.

Green The device is operating in a normal condition. At least one IO connection is in the established state.

Flashing Green The device is OK, but it does not have a connection.A connection may be established, but the Validator has not completed an initial Time Coordination exchange.

Red The device has an unrecoverable fault. Minimum recovery is to cycle power. It may be necessary to replace the device.

Flashing red • The device has a recoverable fault. The fault can be read from the device through the bus or network.

• An IO connection time-out.• Recoverable NVS Fault.• A firmware update is being performed on the module.

Flashing Red/Green • Indicates that you must commission the UNID on the device.

Table 2 - Module ST/FLT Status Indicator

Indicator State Description

Off The digital I/O point is Off.Channel is not configured or enabled.

Yellow The digital I/O point is On.

Flashing red • Open wire / open load• Input/output Off• Short circuit

Red Internal Malfunction

Flashing Red/Yellow • Open load• Output ON / Open wire• Input ON


Troubleshoot Your Module Appendix A

Use the Logix Designer Application for Troubleshooting

The Logix Designer application indicates the presence of fault conditions.

Fault conditions are reported in the following ways:

• Warning Signal in the I/O Configuration Tree

• Status and Fault Information in Module Properties Categories

• Logix Designer Application Tag Editor

Warning Signal in the I/O Configuration Tree

As shown in Figure 1, a warning icon appears in the I/O Configuration tree when a fault occurs.

Figure 1 - Warning Icon in Controller Organizer



Status and Fault Information in Module Properties Categories

The Module Properties section in the Logix Designer application includes a series of categories. The numbers and types of categories varies by module type.

Each category includes options to configure the module or monitor the status of the module. The following are ways to monitor the state of a module for faults:

• Module Status on General Category

• Module Fault Descriptions on Connection Category

• Module Fault Descriptions on Module Info Category

Module Status on General Category

As shown in Figure 2, the status of a module is indicated on the General category of the Modules Properties.

Figure 2 - Fault Message in Status Line



Module Fault Descriptions on Connection Category

As shown in Figure 3, a module fault description that includes an error code that is associated with the specific fault type is listed on the Connection category.

Figure 3 - Fault Description with Error Code

Module Fault Descriptions on Module Info Category

As shown in Figure 4, major and minor fault information is listed on the Module Info tab in the Status section.

Figure 4 - Major and Minor Fault Information



Module and Point Diagnostics

You can use diagnostics in a Logix Designer application project to monitor module and/or point operating conditions and to troubleshoot issues that affect a module and/or point. Diagnostics when the project is online.

• Module Diagnostics• Point Diagnostics

Module Diagnostics

Module diagnostics provide information on a module-wide basis. For example, the Module Diagnostics dialog box indicates the mode within which a module is operating, that is, Run, Remote Run, Remote Program, or Program.

Module Diagnostics are accessible from the Module Info category on the Module Properties dialog box, as shown in Figure 5.

Figure 5 - Module Information Diagnostics



Point Diagnostics

Point diagnostics provide information on an individual point basis. For example, you can check individual points on a 1756-IB16S safety input module for the presence of a Short Circuit condition.

Remember the following:• Not all 1756 ControlLogix digital safety I/O modules provide point

diagnostics.• The point diagnostics that are available vary by module type and

functionality.• There are some differences between modules, but most commonly, the

Module Properties dialog box category from which you can access point diagnostics is Points.

Figure 6 shows how to access output point diagnostics on the 1756-IB16S module and the diagnostics dialog box.




Logix Designer Application Tag Editor

Figure 7 show how fault conditions are indicated in the controller tags.

Figure 7 - Fault Indication in Controller Tags



InternalFault Triggered on the Safety Output Module

Table 3 describes conditions that can trigger InternalFault.

When the conditions that trigger the diagnostics as described in Table 3 are corrected, the output faults are cleared, the tags and diagnostics reset to 0, and the I/O status indicators turn off.

Table 3 - Conditions That Trigger InternalFault

Conditions Output Behavior


• Output Mode - BIpolar• Point Operation Type -

Single• Point Mode - Safety• A load is connected

between a sourcing output point and a sinking output point.

• O.Ptxx.Data tag = 0• An overload resistor shorts

the sourcing output point to 0V DC

Faults I.Ptxx.Fault tag = 1 InternalFault = 1

The I/O status indicator for the faulted output point is steady red.

• Output Mode - Bipolar• Point Operation Type -

Single• Point Mode - Safety or

Safety Pulse Test• A load is connected

between a sourcing output point and a sinking output point.

• O.Ptxx.Data tag = 0• Either output point shorts

to 0V DC

Faults I.Ptxx.Fault tag = 1 InternalFault = 1

• Output Mode - Sourcing• Point Operation Type -

Single• Point Mode - Safety or

Safety Pulse Test• O.Ptxx.Data tag = 1• Output point shorts to

24V DC

Faults I.Ptxx.Fault tag = 1

IMPORTANT: The tag value occurs on the faulted output point and all of its associated group points.

InternalFault = 1

IMPORTANT: The diagnostic value occurs on the faulted output point and all of its associated group points.



Notes:


Appendix B

Module Tag Definitions

Module tags are created when you add a module to the Studio 5000 Logix Designer® application project.

The set of tags that are associated with any module depends on the choices that you make in the Module Definition dialog box.

For the 1756-IB16S and 1756-OBV8S modules, there are Input and Output tags.

Topic Page

Access the Tags 114

Access the Tags 114

1756-IB16S Module Tags 115

1756-OBV8S Module Tags 117

IMPORTANT The tables that are in this section list all tags available with a module. Not all tags in the list are used when that module type is added to a project. Tag use varies by module configuration.


Appendix B Module Tag Definitions

Access the Tags You can view tags from the Tag Editor.

1. Open your Logix Designer application project.

2. Right-click Controller Tags and choose Monitor Tags.

3. Open the tags as necessary to view specific tags.

Name Conventions The module tags use defined naming conventions. The conventions are as follows: (example tag name = remote_ethernet_adapter_1:I.Pt00.Data).

An example module tag name is constructed as follows:• remote_ethernet_adapter = name of the EtherNet/IP™ adapter in the

system• 1 = slot number• I = tag type

For the 1756-IB16S and 1756-OBV8S modules, the possible I/O tag types are I (input) and O (output).

• Pt00 = module point number• Data = function

In this case, Data represents the input data that is returned to the owner-controller.


Module Tag Definitions Appendix B

1756-IB16S Module Tags This section describes the tags that are associated with the 1756-IB16S module.

Input Tags

Table 4 describes the 1756-IB16S module input tags.

Table 4 - 1756-IB16S Module Input Tags

Name Data Type Definition Valid Values Available With These Input Data Type Choices

RunMode BOOL Module operating state • 0 = Idle• 1 = Run

Safety DataSafety Packed Data

ConnectionFaulted BOOL Indicates if a connection is running.The module sets this tag to 0 when connected. If the module is not connected, it changes the tag to 1.

• 0 = Connection running• 1 = Connection not running


DiagnosticActive BOOL Indicates if any diagnostics are active or if the prognostics threshold is reached.

• 0 = No diagnostics active• 1 = One or more diagnostics are active

or the prognostics threshold is reached


Uncertain BOOL Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.For more information, see Module Data Quality Reporting on page 40.

• 0 = Good data• 1 = Uncertain data

This tag is set to 1 when the module has reached a critical operating temperature or is higher the acceptable operating temperature.IMPORTANT: Once the condition that causes the tag to change to 1 is removed, the tag automatically resets to 0.

Safety Packed Data

DiagnosticSequenceCount SINT Increments for each time a distinct diagnostic condition is detected, and when a distinct diagnostic condition transitions from detected to not detected. Set to zero by product reset or power cycle. Wraps from 255 (-1) to 1 skipping zero.

• 1…255The value of 0 is skipped except during module power-up.


Ptxx.Data BOOL Indicates the current safety input value. • 0 = Off• 1 = On


Ptxx.Fault BOOL Indicates one of the following:• The channel data is inaccurate and cannot

be trusted for use in the application.For more information, see Module Data Quality Reporting on page 40.

• The channel is set to Not Used.

• 0 = Good data• 1 = Bad data (faulted) or set to Not

UsedIf the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Input Fault Reset on page 50 to reset this tag to 0.If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

Ptxx.Uncertain BOOL Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.For more information, see Module Data Quality Reporting on page 40.



Safety Data



Output Tags

Table 5 describes the 1756-IB16S module output tags.

Ptxx.ShortCircuit BOOL Indicates a short circuit. • 0 = No short circuit• 1 = Short circuit

Safety Data

Ptxx.Status BOOL Indicates the status of the channel. • 0 = Bad, causing a fault• 1 = Good


Ptxx.TestOutputStatus BOOL • Safety Packed Data

Testxx.Readback BOOL Indicates that a 24V DC power source is present at the test output.

• 0 = 24V DC power is not present • 1 = 24V DC power is present

Safety Data

Testxx.Fault BOOL Indicates one of the following:• The channel data is inaccurate and cannot

be trusted for use in the application.For more information, see Module Data Quality Reporting on page 40.


• 0 = Good data• 1 = Bad data (faulted) or set to Not

UsedIf the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Input Fault Reset on page 50 to reset this tag to 0.(1)

If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

Testxx.Uncertain BOOL Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.For more information, see Module Data Quality Reporting on page 40.



Safety Data

Testxx.ShortCircuit BOOL Indicates an output short circuit • 0 = No short circuit• 1 = Short circuit

Safety Data

Testxx.FieldPowerOff BOOL Indicates that a field power loss condition exists on the channel.

• 0 = No field power off condition• 1 = Field power off condition

Safety Data

Testxx.Status BOOL Indicates the channel status. • 0 = Fault• 1 = Good

Safety Data

(1) If the Point Mode for the test output is Pulse Test or Power Supply when the Short Circuit condition is detected, the condition can be corrected but you cannot set the test output to a safe state.

Table 4 - 1756-IB16S Module Input Tags


Table 5 - 1756-IB16S Module Output Tags

Name Size Definition Valid Values Available With These Output Data Type Choice

Ptxx.ResetFault BOOL When 'Latch Fault until reset via output tag' mode is Enabled, the I/O channel will hold safety input fault indications until it checks that the fault is removed. If the fault is removed, it will clear only the fault status upon detecting that the ResetFault bit in its channel sees a rising edge.

Rising edge: the fault status is released if the fault has been removed.

Safety Data


Module Tag Definitions Appendix B

1756-OBV8S Module Tags This section describes the tags that are associated with the 1756-OBV8S module.

Input Tags

Table 6 describes the 1756-OBV8S module input tags.

Table 6 - 1756-OBV8S Module Input Tags


RunMode BOOL Module’s operating state • 0 = Idle• 1 = Run


ConnectionFaulted BOOL Indicates if a connection is running.The module sets this tag to 0 when connected. If the module is not connected, the controller overwrites the tag to 1.

• 0 = Connection is working• 1 = Connection is not working


DiagnosticActive BOOL Indicates if any diagnostics are active or if the prognostics threshold is reached.

• 0 = No diagnostics active• 1 = One or more diagnostics are active or

the prognostics threshold is reached


Uncertain BOOL Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.For more information, see Module Data Quality Reporting on page 40.



Safety Packed Data

DiagnosticSequenceCount SINT Increments for each time a distinct diagnostic condition is detected, and when a distinct diagnostic condition transitions from detected to not detected. Set to zero by product reset or power cycle. Wraps from 255 (-1) to 1 skipping zero.

• 1…255 Safety DataSafety Packed Data

Ptxx.Readback BOOL Indicates that a 24V DC power source is connected to the output circuit

• 0 = 24V DC power is not present • 1 = 24V DC power is present


Ptxx.Fault BOOL Indicates one of the following:• The channel data is inaccurate and cannot be

trusted for use in the application.For more information, see Module Data Quality Reporting on page 40.


• 0 = Good data• 1 = Bad data (faulted) or set to Not Used

If the tag is set to 1, you must troubleshoot the module to correct the cause of the inaccuracy.IMPORTANT: Once the condition that causes the tag to change to 1 is removed, you must complete the steps described in Safety Output Fault Reset on page 63 to reset this tag to 0.(1)

If the tag is 1 because the channel is set to Not Used, no action is required.

Safety Data

Ptxx.Uncertain BOOL Indicates that the channel data can be inaccurate but the degree of inaccuracy is not known.For more information, see Module Data Quality Reporting on page 40.



Safety Data

Ptxx.ShortCircuit BOOL Indicates a short circuit • 0 = No short circuit• 1 = Short circuit

Safety Data



Output Tags

Table 7 describes the 1756-OBV8S module output tags.

Ptxx.FieldPowerOff BOOL Indicates that a field power loss condition exists on the channel.

• 0 = No field power off condition• 1 = Field power off condition

Safety Data

Ptxx.Status BOOL Indicates the channel status. • 0 = Bad, causing fault• 1 = Good


(1) If the Point Mode for the test output is Pulse Test or Power Supply when the Short Circuit condition is detected, the condition can be corrected but you cannot set the test output to a safe state.

Table 6 - 1756-OBV8S Module Input Tags


Table 7 - 1756-OBV8S Module Output Tags

Name Size Definition Valid Values Available With These Output Data Type Choices

Ptxx.Data BOOL Indicates the current output value. • 0 = Off• 1 = On


Ptxx.ResetFault BOOL When 'Latch Fault until reset via output tag' mode is Enabled, the I/O channel will hold safety input fault indications until it checks that the fault is removed. If the fault is removed, it will clear only the fault status upon detecting that the ResetFault bit in its channel sees a rising edge.

Rising edge: the fault status is released if the fault has been removed.

Safety Data


Appendix C

Application and Wiring Examples for Safety Modules

This appendix provides example wiring diagrams for the 1756 ControlLogix® safety I/O modules that can be used in functional safety applications.

The wiring configuration affects the safety application level to which a 1756 ControlLogix I/O safety module is suitable.

Before You Begin Before you wire your module, remember that a SELV/PELV-rated 24V power supply is required to supply field-side power to 1756 ControlLogix I/O safety modules.

Topic Page

1756-IB16S Module Wiring Diagrams 120

1756-OBV8S Module Wiring Diagrams 123

IMPORTANT This section shows example wiring diagrams on the 1756-IB16S safety input module and the 1756-OBV8S safety output module.


Appendix C Application and Wiring Examples for Safety Modules

1756-IB16S Module Wiring Diagrams

You must connect a 24V DC SELV/PELV power source to the DC+/- terminals to provide field-side power.

When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 2 and PLd as defined in ISO 13849-1.

To achieve that suitability rating, you may have to perform diagnostic testing of the safety function. One diagnostic test method is to configure the safety input channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.

IMPORTANT • The 24V (DC+ and DC-) power connections are used to supply field-side power to the module.

• All terminals with the same name are connected together on the module. For example, DC+ can be connected to either terminal marked DC +.

• Do not physically connect more than two wires to a single RTB terminal.



DC(+)

DC(-)

DC(-)


IN-0TO-0

+-

Channel ConnectionsThe diagram shows devices that are connected to safety input channel 0 and test output channel 0. You can connect devices to all 16 channels.

24V DC SELV/PELV-listed

power supply


Application and Wiring Examples for Safety Modules Appendix C



IN-1IN-2IN-3IN-4IN-5IN-6IN-7IN-8IN-9IN-10IN-11IN-12IN-13IN-14IN-15DC(+)DC(+)

DC(-)DC(-)


TO-0 IN-0

+- 24V DC SELV/PELV-listed

power supply

IMPORTANT Switches are suitable for applications that are rated up to, and including SIL 3 CL3, PLe, Cat 3.

Channel ConnectionsThis diagram shows devices that are connected to safety input channels 0 and 1. You can connect devices to all 16 channels.



When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 4 and PLe as defined in ISO 13849-1. To achieve that suitability rating, you may have to perform diagnostic testing of the safety function.

One diagnostic test method is to configure the safety input channel for Safety Pulse Test to test the circuit for short circuits to 24V DC. Safety input pairs must be associated with different Test Output sources.



DC(+)

DC(-)

DC(-)


IN-0TO-0

+- 24V DC SELV/PELV-listed

power supply

Channel Connections

This diagram shows devices that are connected to safety input channels O and 1; and to test outputs 0 and 1.

You can connect devices to all 16 channels.



1756-OBV8S Module Wiring Diagrams

You can use the 1756-OBV8S module in Bipolar mode or Sourcing mode.

Bipolar Mode


To achieve that suitability rating, you may have to perform diagnostic testing and monitoring of the safety function. One diagnostic test method is to configure the safety output channel for Safety Pulse Test to test the circuit for short circuits to 24V DC.

IMPORTANT • The 24V (DC+ and DC-) power connections are used to supply field-side power to the module.

• All terminals with the same name are connected together on the module. For example, DC+ can be connected to either terminal marked DC +.

• Do not physically connect more than two wires to one RTB terminal.

DC(+) DC(-)

DC(+) DC(-)

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT5-P

OUT6-P

OUT7-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-M

OUT5-M

OUT6-M

OUT7-M

+ -

K

M

24V DC SELV/PELV-listed power

supply

Channel ConnectionsThis wiring example shows connections to Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channels as determined by your application.

We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect module DC- and actuator DC- together. This practice helps to eliminate grounding float from disrupting diagnostics.



When the module is wired as shown, it is suitable for applications that are rated up to, and including, Category 4 and PLe as defined in ISO 13849-1.


• The application is configured so that a No Load fault can only be detected if the wires from both the P- terminal and the M-terminal are disconnected.

For Cat.4 applications, if your application remains in safe state, that is, the output is off, for a prolonged duration, we recommend that you take one of these actions:

• Apply output monitoring at the actuator. The monitoring can be direct or indirect.

• Limit the safe state to no more than 24 hours.• Conduct functional test if safe state dwell time increases.

DC(+) DC(-)

DC(+) DC(-)

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT5-P

OUT6-P

OUT7-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-M

OUT5-M

OUT6-M

OUT7-M

+ -24V DC

SELV/PELV-listed power supply

Channel ConnectionsThis wiring example shows connections to the P-M pair for Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channel pairs as determined by your application.

Connection PairsThe terminals for each channel function as a Bipolar connection pair when you use a 1756-OBV8S module in Bipolar switching mode. For example, the Safety Output 0 P (Sourcing) terminal and Safety Output 0 M (Sinking) terminal are a Bipolar connection pair. That is, they are a P-M pair.

When the module is in Bipolar switching mode, you must connect the device to both terminals.

We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect the DC- terminals together. This practice helps to eliminate grounding float from disrupting diagnostics.

K

K

M





• We strongly recommend that you connect separate shielded cables to the P terminal and the M terminal to reduce possibility of a short between these terminals. If a short is detected across the P-M pair, the module outputs are turned off, but the actuator that is connected to the output pair remains on.

• No Load and Overload conditions are only detectable at the P terminal.




DC(+) DC(-)

DC(+) DC(-)

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT5-P

OUT6-P

OUT7-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-M

OUT5-M

OUT6-M

OUT7-M

+ -

Actuator DC PowerIn this wiring configuration, you must connect the DC+ terminal to an SELV/PELV-listed power supply.

The DC+ and DC- on the actuator must be connected to the same power supply as the DC+ and DC- on the module.


supply

DC –

DC +

Channel ConnectionsThis wiring example shows connections to the P-M pair for Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channel pairs as determined by your application.

We strongly recommend that, if you have a direct connection between the safety output module and an input module and those modules are powered by separate power supplies, you connect the DC- terminals together. This practice helps to eliminate grounding float from disrupting diagnostics.

Connection PairsThe terminals for each channel function as a Bipolar connection pair when you use a 1756-OBV8S module in Bipolar switching mode. For example, the Safety Output 0 P (Sourcing) terminal and Safety Output 0 M (Sinking) terminal are a Bipolar connection pair. That is, they are a P-M pair.

When the module is in Bipolar switching mode, you must connect the device to both terminals.

K

K

M



Sourcing Mode



DC(+) DC(-)

DC(+) DC(-)

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT5-P

OUT6-P

OUT7-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-M

OUT5-M

OUT6-M

OUT7-M

+ -

K

MDC –


supply

Channel ConnectionsThis wiring example shows connections to Safety Output 0. You are not limited to using channel 0 in this mode. You can use all channels as determined by your application.









DC(+) DC(-)

DC(+) DC(-)

OUT0-P

OUT1-P

OUT4-P

OUT3-P

OUT2-P

OUT5-P

OUT6-P

OUT7-P

OUT0-M

OUT1-M

OUT2-M

OUT3-M

OUT4-M

OUT5-M

OUT6-M

OUT7-M

+ -

Connection PairsWhen you use dual-channel sourcing wiring on the 1756-OBV8S module, you must connect the devices to dual-channel connection pairs. For example, the devices are connected to channels 4 and 5 because they are a connection pair. These channels are dual-channel connection pairs:

• Channels 0 and 1 (shown)

• Channels 2 and 3

• Channels 4 and 5

• Channels 6 and 7DC –


supply

Channel ConnectionsThis wiring example shows connections to Safety Output 0 P and Safety Output 1P. You are not limited to using channels 0 and 1 in this mode. You can use all channel pairs as determined by your application.


M

K

K



Notes:


Appendix D

Safety Data for Safety Modules

This appendix lists calculated values for probability of a dangerous failure on demand (PFD), average frequency of a dangerous failure per hour (PFH), and mean time to failure (MTTF). PFD and PFH calculations comply with IEC61508, edition 2, 2010.

• For the 1756-IB16S, calculated values of PFD and PFH appear in Table 8 on page 130

• For the 1756-OBV8S, calculated values of PFD and PFH appear in Table 9 on page 131 .

PFD and PFH must be calculated for the devices within the system to comply with the SIL level that is required for application.

You are responsible for following the requirements of ISO 13849-1:2008, to assess Performance Levels in your safety system.

You must functionally test every I/O module by individually toggling each input point and also verify that the controller detects it within the safety reaction time (SRT). Additionally, you must individually toggle each output point by the controller and user-verified that the output point changes state.

For more information, see the GuardLogix® 5580 and CompactGuardLogix 5380 Controller Systems Safety Reference Manual, publication 1756-RM012.



Appendix D Safety Data for Safety Modules

1756-IB16S Safety Data Table 8 lists the safety data for the 1756-IB16S module.

Table 8 - 1756-IB16S Module Safety Parameter Data

Attribute

Point Operation Type

Single Channel Dual Channel(at controller instruction

level)

Safety Function Architecture (HFT) 0 1

Safe Failure Rate (λs) [failures/hr] 7.9621E-07 8.6252E-07

Safe Detected Failure Rate (λSD)(1) 7.95153E-07 8.61767E-07

Safe Undetected Failure Rate (λSU)(1) 1.05746E-09 7.52962E-10

Dangerous Failure Rate (λD) [failures/hr] 4.49496E-07 5.34022E-07

Dangerous Detected Failure Rate (λDD) [failures/hr] 4.48899E-07 5.33556E-07

Dangerous Undetected Failure Rate (λDU) [failures/hr] 3.80996E-10 4.6619E-10

SRT [millisecond] 6

Automatic Diagnostic Test Interval (TD) [hr] 4

Useful Life [yr] 20

Systematic Capability (SC) 3

Safe Failure Fraction (SFF) [%] 99.97% 99.97%

PFH 3.80996E-10 4.6619E-10

PFDAVE 10 yrs 1.66876E-05 2.04191E-05

Mission Time™ 20 yrs 3.33753E-05 4.08383E-05

Diagnostic Coverage Average (DCAVE) 99.87% 99.91%

Spurious Trip Rate (STR) 5.90E-06 —

MTTF [years] 91.64 81.74

MTTFD [years] 253.96 213.76

(1) (λSD) and (λSU) are calculated with assumption of Diagnostic Coverage of Safe Failure is same as Diagnostic Coverage of Dangerous Failure


Safety Data for Safety Modules Appendix D

1756-OBV8S Safety Data Table 9 lists the safety data for the 1756-OBV8S module.

Table 9 - 1756-OBV8S Module Safety Data

Attribute

Output Mode

Sourcing Bipolar

Point Operation Type Point Operation Type

Single Dual Single

Safety Function Architecture (HFT) 0 1 1

Safe Failure Rate (λs) [failures/hr] 1.16E-06 9.3E-07 9.5E-07

Safe Detected Failure Rate (λSD)(1) 1.16E-06 9.3E-07 9.5E-07

Safe Undetected Failure Rate (λSU)(1) 4.23E-10 5E-10 4.9E-10

Dangerous Failure Rate (λD) [failures/hr] 9.01E-07 5.9E-07 6.1E-07

Dangerous Detected Failure Rate (λDD) [failures/hr] 9.01E-07 5.9E-07 6.1E-07

Dangerous Undetected Failure Rate (λDU) [failures/hr] 3.29E-10 3.1E-10 3.1E-10

SRT [millisecond] 4.5

Automatic Diagnostic Test Interval (TD) [hr] 4

Useful Life [yr] 20

Systematic Capability (SC) 3

Safe Failure Fraction (SFF) [%] 99.98% 99.98% 99.98%

PFH 3.29E-10 3.1E-10 3.1E-10

PFDAVE 10 yrs 1.44E-05 1.4E-05 1.4E-05

Mission Time™ 20 yrs 2.89E-05 2.8E-05 2.8E-05

Diagnostic Coverage Average (DCAVE) 99.96% 99.95% 99.95%

Spurious Trip Rate (STR) 3.99E-06 2.68E-06 2.79E-06

MTTF [years] 55.50 75.09 72.91

MTTFD [years] 126.69 194.80 186.19

(1) (λSD) and (λSU) are calculated with assumption of Diagnostic Coverage of Safe Failure is same as Diagnostic Coverage of Dangerous Failure


Appendix D Safety Data for Safety Modules

Notes:


Index

Cconfiguration

reset safety modules to out-of-box configuration 93

configurewith Logix Designer application 39

connection 7connection category

1756-IB16S and 1756-OBV8S modules 85connection types 28controller organizer

monitor tags 92view module tags 92

Ddata transmission

multicast method 28data types

available with I/O modules 28

EEDS

See electronic data sheetelectronic data sheet 7

Ffirmware

obtain from PCDC 44

Ggeneral category

1756-IB16S and 1756-OBV8S modules 83

II/O status indicators

safety input modules 104input points category

1756-IB16S module 88

Kkeying

mechanical 21, 22

Lload current

digital output module 67local I/O modules 23, 31, 33locking tab 21, 22Logix 5000 controllers

ownership of I/O modules 24

Logix Designer application 39configuration overview 26connection types 28module definition

safety modules 84module tag definition 113name module tags 114replace a safety module 93 - 102reset safety modules to out-of-box

configuration 93safety modules configuration 77 - 102safety network number 83tag editor 114view module tags 92

Mmasters 7mechanical

keying 21, 22module definition

dialog boxsafety modules 84

module info category1756-IB16S and 1756-OBV8S modules 87

module locationlocal I/O modules 23remote I/O modules 24

module tagsdefinition 113naming 114tag editor 114view 92

multicastdata broadcast method 31

Nno load detection

minimum time 67

OODVA 7out-of-box 96ownership 24

PPCDC

obtain firmware 44PFD 7

See probability of failure on demand.PFH 7

See probability of failure per hour.probability of failure

on demand 7per hour 7

proof test 8


Index

Rremote I/O modules 24, 32, 33removable terminal block 10replace a safety module 93 - 102reset safety modules to out-of-box

configuration 93RPI

valid value 30RTB. See removable terminal block

Ssafety category

1756-IB16S and 1756-OBV8S modules 86safety network number 8, 83short circuit protection

digital output modules 68safety input modules 56

slaves 7SNN 8

See safety network number.status indicators 21, 22

safety input modulesI/O status indicators 104

Ttest output points category

1756-IB16S module 89thermal switch

digital output modules 70troubleshooting

connection category 107general category 106module Info category 107module status indicators 21, 22safety input modules

I/O status indicators 104tag editor 110

Vvoltage range

digital I/O module 10

Wwiring connections

removable terminal block 10


Publication 1756-UM013B-EN-P - October 2019Supersedes Publication 1756-UM013A-EN-P - June 2019 Copyright © 2019 Rockwell Automation, Inc. All rights reserved. Printed in the U.S.A.

Rockwell Automation Support

Use the following resources to access support information.

Documentation Feedback

Your comments will help us serve your documentation needs better. If you have any suggestions on how to improve this document, complete the How Are We Doing? form athttps://literature.rockwellautomation.com/idc/groups/literature/documents/du/ra-du002_-en-e.pdf

Technical Support Center Knowledgebase Articles, How-to Videos, FAQs, Chat, User Forums, and Product Notification Updates.

https://rockwellautomation.custhelp.com/

Local Technical Support Phone Numbers

Locate the phone number for your country. http://www.rockwellautomation.com/global/support/get-support-now.page

Direct Dial Codes Find the Direct Dial Code for your product. Use the code to route your call directly to a technical support engineer.

http://www.rockwellautomation.com/global/support/direct-dial.page

Literature Library Installation Instructions, Manuals, Brochures, and Technical Data.

http://www.rockwellautomation.com/global/literature-library/overview.page

Product Compatibility and Download Center (PCDC)

Get help determining how products interact, check features and capabilities, and find associated firmware.

http://www.rockwellautomation.com/global/support/pcdc.page

.

Rockwell Otomasyon Ticaret A.Ş., Kar Plaza İş Merkezi E Blok Kat:6 34752 İçerenköy, İstanbul, Tel: +90 (216) 5698400

Rockwell Automation maintains current product environmental information on its website at http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page.

Allen-Bradley, Compact 5000, ControlLogix, GuardLogix, Kinetix, Logix 5000, PanelView, PowerFlex, RSNetWorx, Rockwell Automation, Rockwell Software, Safety Automation Builder, Stratix, and Studio 5000 Logix Designer are trademarks of Rockwell Automation, Inc.

CIP, CIP Safety, ControlNet, DeviceNet, and EtherNet/IP are trademarks of ODVA, Inc.

Trademarks not belonging to Rockwell Automation are property of their respective companies.

http://www.rockwellautomation.com/rockwellautomation/about-us/sustainability-ethics/product-environmental-compliance.page

Documents

1756 ControlLogix Digital Safety I/O Modules User Manual, 1756 … · 2019. 11. 1. · ControlNet®, and DeviceNet® communication networks. CIP Safety™ Common Industrial Protocol